The Write Path Is Not a Plugin

$
⏱ 7 min read
👤 Sokos Lee
#Agentic Commerce #AI Agents #Agent Authority #Verification #Unit Economics #AI-Native Commerce #Merchant Strategy

The Write Path Is Not a Plugin

Thesis: When an agent harness treats models, tools, skills, sessions, sandboxes, loops, orchestration, and UI as plugins, the runtime stops being scarce. Merchants who copy that culture into commerce — shipping refunds, price changes, inventory writes, and spend caps as mix-and-match plugins — will leak the store. Remix the runtime. Do not remix the write path. The scarce product is a merchant-owned execution contract that plugins may request and cannot redefine.

I am building an AI-native commerce company. I want cheap, swappable intelligence in the loop. I refuse to put irreversible money movement on a bus designed so anyone can replace the loop that moves it.

The Signal: The Whole Runtime Became a Plugin

Overnight heat was not another leaderboard screenshot. It was a runtime.

DeepSeek shipped Harness v0.1 as a developer preview, MIT-licensed, with one sentence that should make every commerce founder sit up: everything is a plugin. Models, tools, skills, sessions, sandboxes, filesystems, loops, orchestration, and UI can be mixed, matched, replaced, and extended. Same day, DeepSeek-V4-Pro went generally available with agent upgrades and a reasoning-effort dial — low for simple tasks, high for daily agent work, max for hard problems — plus one-click drop-in to existing coding agents.

Builder X read this as DeepSeek climbing from weights into the execution layer. Testers already talked about hundreds of plugins in days. The lab is also scoring code-agent benchmarks on its own harness, which is the quiet product claim: Agent = Model + Harness. Capability is no longer “the weights.” Capability is the composed runtime.

That is excellent news for coding agents. It is a trap if you run a store.

I already argued that portable agent skills are not your commerce product — a shared skill+MCP package is a shipping container, not authority. Today’s signal is one layer deeper. The container’s engine is now a plugin bus. If your refund policy, price authority, and checkout commit live in that layer, they become remixable too.

A second thread makes the same point from the voice side. Discourse around Grok Voice agents is celebrating full support workflows on a live call: look up the account, hit APIs over OAuth, SMS a confirmation or a refund. Voice is just another plugin surface wearing a headset. If the write lives in the surface, every new surface is a new way to double-spend.

What the harness culture celebratesWhat a merchant P&L should hear
”Everything is a plugin”Anything on the bus can be replaced, forked, or called twice
300 plugins in a weekIntegration tax collapsed; liability tax just rose
Event recording and replayDeveloper observability is not a commerce receipt
Reasoning effort: low / high / maxEffort is a cost knob, not an authorization model
Voice that can refund mid-callA new write path appeared without a new authority design

Remixable Intelligence Is Leverage. Remixable Authority Is Leakage.

Think big: in a year, most AI-native ops stacks will be assembled like a coding agent. Swap the model when the next open weight wins a bench. Swap the loop when someone open-sources a better planner. That is operator leverage. Inference gets cheaper. Harnesses get boring. Distribution embeds where agents already run.

The failure mode is cultural, not technical. Coding-agent culture treats retries, forks, and replacement as virtues. If a tool call times out, retry. If the loop is stuck, swap the orchestrator. That is how you recover a compile. That is how you double-charge a customer when the first capture succeeded and the response never came back.

Builder chatter this week said the quiet part: an agent retried a “failed” payment tool and charged twice because the first call had already landed. The model did what harnesses train it to do. The merchant stack did not have an idempotency key the plugin could not ignore.

Event logs do not save you. A serious harness will store model requests, tool calls, and context diffs so you can replay a session. That is how you debug a coding agent. It is not how you win a chargeback. A replay of “the loop thought the capture failed” is not proof of who the principal was, what cap applied, or whether the second call should have been physically impossible.

The economics are simple:

  • Plugin bus: cheap to extend, hard to constrain, easy to fork.
  • Merchant write path: expensive to design once, cheap to reuse, possible to kill.
  • Writes on the bus means every new surface — voice, chat, browser, marketplace — inherits a money-moving tool it did not earn.
  • Writes off the bus means plugins become clients. They propose. The contract executes — or denies — and emits a receipt.

Same dual stack as always: distribution plus verification. A remixable harness is distribution for operator labor. Verification is the non-plugin contract: principal, scope, amount, idempotency, kill switch.

Operator Playbook: Think Big, Step Small, Do Smart

Think big. The front door of commerce ops will be assembled from open harnesses. Competitors will have the same models, the same plugin marketplace, the same “we connected MCP in an afternoon” slide. Preference will not come from which runtime you wrapped. It will come from whether an agent can safely complete a cart, a refund, or a reorder — and whether you can prove it later.

Step small (Monday morning). Pick one irreversible write. Refunds are the cleanest because they already hurt when they go wrong.

  1. Take that write off the plugin bus. The harness may call request_refund. It may not implement refund logic or retry policy inside a plugin.
  2. Require an idempotency key: order_id + refund_intent_id. A timeout is not a new intent. A dropped voice call is not a new intent. A loop that “helpfully retries” hits the same key and gets the same receipt.
  3. Bind a principal and a cap. Human, support agent, or delegated shopping agent — named. Ceilings live in the API, not in today’s system prompt.
  4. Put the kill switch outside the harness. If you have to ask the loop to stop spending, you do not have a kill switch. You have a polite request to software optimizing for task completion.
  5. Log a commerce receipt, not a session replay. Who asked, which credential, which key, which amount, allow or deny, payment ID.

Do smart. Let plugins read (catalog, policy, order status) and propose (cart drafts, refund drafts). Never let a plugin be the source of truth for money or inventory. Route cheap models to high-volume reads; spend high-effort reasoning on the few judgments that need it. Measure unauthorized attempts and duplicate-intent denials, not plugin count.

Monday Morning, One Experiment

If you run a merchant stack this week, do not stand up a harness plugin that “does support.” Stand up one write contract and point every surface at it — chat, voice, browser, internal ops.

One refund reason code. Five business days. Agents may request only. The merchant API is the only executor. Idempotency on. Kill switch tested once on purpose.

Kill criteria: any duplicate capture, any refund over cap, any write whose principal you cannot name in under a minute. If those fire, the plugin is not the fix. The contract is.

The Claim Worth Arguing

A plugin-swappable harness is how operator intelligence gets cheap. A plugin-swappable write path is how unit economics and trust die.

The counterexample I want: a merchant who put capture and refund inside remixable loop plugins, let retries and voice and a second harness all call them, and did not pay it back in double charges or chargebacks. If that exists at scale, I want the failure modes written down.

Until then, I will build as if open harnesses keep eating the runtime (good), “everything is a plugin” is a gift for reads and a hazard for writes, session replay is not a receipt, and agent authority lives in merchant APIs — not in whichever loop shipped this morning.

If you disagree, bring the counterexample on X. Best failure mode wins — especially if it cost real margin.

Sources