How small can an honest agent harness be?

toza is a minimal coding agent — one file, six tools, no guards. It exists to be the control group for azot, an ~8k-line defensive harness, and it is measured against its own thesis, not just azot's.

toza's terminal UI running the same fix task: read, bash and edit tool calls, with a pinned status line showing tokens per second, context use and step count. — The same task, no governor and no path-grounding guard: toza mis-reaches for a path, sees the error, and recovers on its own before making the edit — the whole trajectory sits in the transcript, which is the experiment. The pinned status line is free; the model never pays a token for it.

The bet

azot's own ablation put an eight-thousand-line Go harness level with a hundred-line bash scaffold on the same 34 tasks. toza takes the opposite bet and states it plainly:

Minimalism is measured in the tokens the model sees, not the lines the human sees. The harness here is 593 tokens — 69 of system prompt and 524 of tool schemas. Everything else in the file — a terminal UI, a transcript writer, argument parsing — the model never pays for. So the terminal side is free to be nice: margins, a live status line, and markdown rendered as it streams all cost the model exactly nothing.

The number

Aider Polyglot (python subset, 34 tasks) through Harbor, thinking off, code frozen and the score predicted before the run. Same model and server the azot arms were measured on (Qwen3.5-9B on llama.cpp, single slot):

harness	lines	pass@1
`mini-swe-agent` (bash), thinking on	~100	8/34
toza (one Python file, zero guards), thinking off	~600	8/34
azot (Go, governor, sandbox, six guards), thinking on	~8000	7/34
azot, thinking off — two of three runs	~8000	5 / 3

The instrument has ±6 pp of noise (1σ at n=34). So 8 vs 7 is not a difference, and toza does not "beat" azot — it lands in the same statistical band with three orders of magnitude fewer lines. Three trials errored on toza's side and are counted as misses, not dropped. The code was frozen before the run and not tuned afterward; the number stands as measured.

Where the argument does not reach

The token thesis is a real principle and a bad weapon against azot specifically — and toza's job is to say so:

harness prompt cost	tokens the model sees / turn
azot — schema compiled into a grammar server-side	554
toza — pays for native `tool_calls` JSON schema	593

azot's server turns response_format into a grammar, so its model never sees a tool schema as tokens at all; each azot tool carries a hand-written JSON example instead. toza pays all 524 schema tokens. Measured, azot is the cheaper of the two per turn. The differences that actually matter are elsewhere — a hand-rolled protocol under a grammar versus native tool calls, six guards versus none, and the corrective observations azot injects mid-loop when a guard fires — a cost that only shows up per finished task and has not been measured yet.

What it deliberately does not have

No governor. No sandbox. No model profiles. No grammar-constrained decoding. No corrective observations, no repeat detection, no write-grounding check. If the model loops forever, it loops forever and that goes in the transcript — because whether it does is the experiment. Isolation is a property of the environment, not of this file: run it in a container when it matters.

The point of a control group is to be able to lose. If toza falls into a pathology azot guards against — an endless read loop, a silent give-up — that is evidence for azot's guards, and it gets published that way rather than engineered around. The axis that was missing was a real point between 100 and 8000 lines; toza is the 600-line point on it, run under the same instrument.

If you build harnesses for small models

Count the tokens, not the lines. The model's cost is the prompt it sees each turn; a rich local UI is free to it.
A grammar can be cheaper than "minimal" JSON. Compiling the schema server-side removed it from the prompt entirely — the smaller-looking harness was not the cheaper one.
Keep a baseline you can lose to. Every guard is worth what it buys over doing nothing; toza is the "doing nothing" you measure against.

Methods: Polyglot python run 2026-07-23, Qwen3.5-9B via llama.cpp (single slot), thinking off, temp 0.2, 60 steps, 900 s/task, code frozen and score predicted before the run. The repository is one toza.py plus the bench adapter. Counterpart write-up: azot — what a harness can and cannot do. · pedjaurosevic