"Why does Codex CLI score the same as OpenCode (34/55) despite being very different?"	Same total, different PROFILE. Codex wins on loop performance + error handling (Rust). OpenCode wins on context + memory + sandboxing (client/server). The score is identical; the tradeoff is orthogonal — language-level correctness vs architecture-level.	harness-engineering::dd04::analysis
"Name 3 advantages Codex gets from being written in Rust."	(1) Single binary — no runtime, no GC pauses, fastest startup. (2) Memory safety — no buffer overflows in the harness itself. (3) Apache 2.0 + single binary = most forkable/auditable harness.	harness-engineering::dd04::recall
"State Codex's 3-tier permission model."	suggest (propose only, no execution) · auto (execute safe ops: read/search) · full (execute everything including bash/write). A simplified risk-tiered model — fewer tiers than Claude Code's 40 flags, same principle.	harness-engineering::dd04::recall
"Does Rust's memory safety protect against prompt injection?"	NO. Rust protects the HARNESS BINARY (no buffer overflows, use-after-free). Injection targets the MODEL'S BEHAVIOR via tool outputs — that's orthogonal to the harness's memory safety. Rust eliminates a class of harness vulnerabilities, not agent-behavior vulnerabilities.	harness-engineering::dd04::analysis
"Why is Apache 2.0 + single binary 'most forkable'?"	Apache 2.0 = permissive license (no copyleft friction). Single binary = you can read the WHOLE codebase, compile, and ship without managing a runtime. No node_modules, no pip — just one file. Maximum auditability.	harness-engineering::dd04::analysis
"Name 3 things to fix if you forked Codex."	(1) Add Docker sandboxing (OS-level process isolation < container isolation). (2) Improve context management (behind Aider/OpenCode). (3) Add computed verification (Module 9 weak).	harness-engineering::dd04::application