The harness is 1,574 lines. The job is the other 354,000.

Someone looked at how I run AI agents and asked the obvious question: "No goose? It's free, local."

Fair question. It deserves a real answer instead of a defensive one, because Goose is good. It is an open source AI agent that runs as a desktop app, a CLI, and an API. It speaks to fifteen or so model providers, it is MCP native, it is Apache 2.0, and since December it has lived at the Linux Foundation's Agentic AI Foundation alongside MCP itself. Fifty three thousand stars. Nothing about it is a toy.

I still don't run it, and when I went looking for the honest reason I ended up counting lines of code. The number surprised me enough that I think it is the actual point.

What "free" and "local" are really buying

There are two reasons anyone wants an agent running locally. You stop paying per token and pay for hardware instead. And your data never leaves the building.

Both are real. Neither is something a harness can give you, because a harness is not a model. Goose is an agent loop plus tool plumbing. It does not ship intelligence in the box.

So on cost: you still need either a GPU large enough to run something competent, which is a rental invoice rather than free (a single H100 was running about $2.69 an hour when I last priced one), or a cloud API, which is per-token spend exactly like the day before you installed it. The local model I do run is a 2.6 billion parameter model, grammar constrained, permitted to propose one of six read-only actions and physically unable to emit anything else. That is what that size is honestly worth. It cannot review a Laravel application. Nothing that fits comfortably in system RAM can, yet.

And because the cost problem is unsolved, the data problem is unsolved with it. If the model is still in the cloud, the bytes still leave, whatever is driving the loop.

A detour, because the industry is sloppy about this

When work does go to an outside model, the reassuring phrase is zero data retention. I route client code through providers that offer it. I want to be precise about what that actually is, though, because I catch myself describing it as a guarantee.

The flag I send is a provider selection filter. It restricts which upstream endpoints are eligible to serve the request. I have positive evidence it is honored, in that one model I use passes normally and returns a hard 404 under the zero-retention flag, which cannot happen unless the option genuinely changes routing. That is evidence of routing. It is not evidence of deletion anywhere.

Read the broker's own words. Their docs say the data policy setting "has no bearing on OpenRouter's own policies and what we do with your prompts." Their privacy policy says any text you input "will also be collected by us," retained "as long as is reasonably necessary to comply with our business and legal obligations," with no timeframe attached. The explicit non-persistence promise covers images, audio, and video, not text. And on the model provider at the far end: "We do not control, and are not responsible for, LLMs' handling of your Inputs or Outputs."

So a zero-retention request is a three link chain. The broker honors the filter, which I can evidence. The broker itself keeps the prompt under an open-ended clause the flag explicitly does not touch. The provider at the end honors a contract I cannot see, audit, or test. It is a contract, not a proof, and it is worth having on exactly those terms.

Which means the controls that actually bound exposure are all on my side of the wire: send diffs and never whole repositories, scan everything for secrets locally and refuse to transmit on a hit, carry a per-repository policy that the tooling enforces and that fails closed when the field is missing or misspelled, and deny the most sensitive repositories outright. Swapping which CLI drives the loop changes not one of those.

So I counted

The harness layer here is a launcher I wrote called Walter. It prints a dashboard, offers a lane, and hands the terminal to whichever CLI I picked. Including its little on-box model, it is 1,574 lines of bash.

That is the entire prize. Goose could replace all of it and would do parts of it better. Here is what those 1,574 lines are sitting on top of:

• 20 operational playbooks, 14,270 lines. Every trap I have paid for once, written down with the incident that minted it, so the next session does not rediscover it at a client's expense.
• 49 per-project context files, 11,562 lines. What each repository is, how it actually deploys, and the specific things people reliably get wrong about it.
• 74 CI workflows across 25 repositories, 9,596 lines, plus 69 linter and static analysis configs pinned at repository roots so the same gates run on my laptop and in CI.
• 1,273 test files, 304,127 lines across 33 repositories. One large project accounts for 187,000 of those, so call it 117,000 across the other 32 if you want the conservative number.
• A registry of 76 projects where every entry carries a machine-enforced policy for which agents may touch it and how.
• Roughly 12,000 more lines of house rules, reference docs, and automation for the review stack and the nightly jobs.

Call it 354,000 lines against 1,574. About 225 to 1. Throw the tests out as not counting and it is still 32 to 1.

Why that ratio is the whole argument

Every line in the long column works identically no matter which CLI is driving, because none of it is about the CLI.

An agent's usefulness is bounded by two things. How much true, current, written context you can hand it. And how much of its output can be checked without a human reading every line. The first one is the playbooks, the project files, and the registry. The second one is the tests, the gates, and the CI. Neither is a feature any harness vendor can ship you, because both are specific to your systems and both are earned by getting things wrong first and writing down what happened.

That is also why the harness question feels bigger than it is. Choosing a harness is a visible, researchable, opinion-having decision. Writing down why a deploy broke at 11pm two Octobers ago is none of those things. The second one is the work.

Where Goose is the right answer

If you are starting from nothing today, Goose is a defensible foundation, and I want to be honest that my own reason for not having it is unimpressive. When I built my launcher, the fallback lane went to a different CLI because that CLI was already installed. That is inertia, not a principle. Goose was already at the Linux Foundation by then.

Two things temper it. It would have saved none of the 354,000 lines, all of which I would have had to write anyway. And once you care about output quality on real code, you tend to want a vendor's own CLI for the seat that does the writing, because those are tuned to their own model in ways a neutral harness structurally cannot match. Start neutral and you often end up running two harnesses, which is the cost I am declining to pay from the other direction.

The thing I am not going to claim is that my launcher is better than Goose. It is 1,574 lines of bash. That is the point. It is small enough to be beneath the argument.

A worthwhile ten minutes

Count your own ratio. Add up the harness and glue you have written to make AI agents work, then add up the tests, the CI, the runbooks, and the written-down context they operate against. If the first number is a meaningful fraction of the second, the harness is not your problem. The substrate is missing, and no amount of switching tools will produce it.

If the second number dwarfs the first, congratulations, you already have the expensive part. Your harness is a steering wheel, swapping it is a weekend, and you can stop reading comparison threads.