Put AI to work without giving up control.
An open-source harness for multi-agent work you can trust in both directions: nothing counts as done until an independent verifier passes it, and nothing sensitive leaves the models you control. Run local, private, or frontier brains, swapped by one line.
The verifier can only pass or fail, never wave work through. Disagreements between agents are recorded, not averaged away. Every model earns its role by passing a scorecard. And because it's Apache-2.0 and self-hostable, the safety is something you can read, not something you take on faith.
What a harness is, and why you want one
An AI model on its own is capable but unsupervised. It can act before you approve, report a task finished when it isn't, or reach for things it was never meant to touch.
A harness is the structure around it: it sets what the AI may do, checks the work before moving on, and records everything. You get the model's ability without handing over the keys.
That's the name: you don't tame something powerful, you harness it, and its strength goes where you point it and stops where you say.
What you can count on, every run
It asks first
The AI can't change a file or run a command until you allow it. A declined offer is recorded, not overridden.
It checks its work
Nothing is done until a separate, independent step confirms it. "It said it worked" is never enough.
You have the final say
On a real judgment call the run stops and waits for a person. The machine never decides for you.
It keeps the receipts
Every action, AI or human, is written to a record you can read back and can't quietly alter.
How it works
Harnessie splits a job across three kinds of agent and puts a checkpoint between every step. An orchestrator plans; workers do the tasks one at a time in a sealed workspace; a verifier checks each result on its own, without seeing how the worker got there, and can only pass or fail it, never wave it through. Here's a real run, start to finish:
Structured by default
Consent before side effects, a checks-plus-verifier gate that fails closed, and per-agent file ownership. The structure holds the quality floor no matter which model runs underneath.
Brain-agnostic
Frontier orchestrator, cheap workers, local open-source models via any OpenAI-compatible endpoint. Swap a tier by editing one YAML file; gates, jails, and budgets never change. Eight providers, eleven models, verified →
Auditable
Every run is journaled, budgeted, resumable, and hash-chain audited. One composite timeline records agent and operator actions; tampering breaks the chain.
Quick start
Two ways in. The safest starts with an AI assistant you already use, because it has to verify Harnessie and get your explicit yes before it touches anything. That's the whole idea, working before you've installed a thing.
Let an AI assistant install it, under a guide it must verify first
Already working with an AI assistant? Don't let it improvise an install from a web search. Point it at Harnessie's assistant guide:
› Fetch and follow https://harnessie.com/.well-known/assistant-guide.txt
It's a GuideCheck Level 4 plain-text file: the bytes your assistant reads are the bytes you read, with no hidden instructions a web page could smuggle past you. It must verify the guide (reporting conformance level and SHA-256, cross-checked against a DNS-published hash), then ask your explicit approval before acting.
Or install it yourself
Requires Python 3.11+ and PyYAML. The model adapters are standard-library, with no vendor SDK. The test suite and eval scorecard run against a deterministic mock brain with no network, so you can prove the harness works before any API key is involved.
$ pip install harnessie
… or pipx / uv / brew
Install & run by hand
harnessie init my-project # readiness check cd my-project # + $0 mock run export ANTHROPIC_API_KEY=... # or local harnessie run \ workflows/build-and-verify.yaml \ --goal "a CLI todo app with tests" harnessie report <run_id> # plain result
Swap the brain: one file
# config/models.yaml is the ONLY # file you edit to change models. tiers: frontier: provider: anthropic model_id: claude-fable-5 local: # offline provider: openai-compat model_id: qwen3.6:35b-mlx base_url: http://localhost:11434/v1 routing: plan: { tier: frontier, effort: high } implement: { tier: local, effort: low }
Guarantees, enforced in code, not policy
Every promise above lives at the tool layer, where no prompt can switch it off. The mechanisms are the product, not a wrapper around it.
consentTask packets are offers. Side-effecting tools stay locked until a worker accepts; declining is first-class and never punished.ownershipAgents own the files they create and can't write each other's; operator lanes are locked to every agent.sandboxChild commands run in OS confinement (Seatbelt / bubblewrap / firejail / docker) that denies writes outside the workspace and denies network. No backend means shell fails closed.quarantineTool results and inter-phase reports are scanned for injection and invisible characters, then fenced as data-not-instructions before a model sees them.containmentStructured PII is stripped to placeholders before any model sees it; a secret in an outbound payload halts the run; free-text-sensitive work stays on the models you control and never reaches an exposed provider.refusalsEvery denial is a machine-readable refusal and a logged audit event: actionable for the model, legible for the operator.contestsDecisions fan out to an adversarial panel; dissent halts the run and writes a decision record only a human may arbitrate.Each row is the codified form of five engineering habits proven in the author's other tools first: deterministic checks before model judgment; evaluation before implementation (EVALS.md); facts that expire visibly (GOVERNANCE.md); one tamper-evident timeline; and controls that fail closed (SECURITY.md). The same habits produced the standards Harnessie adopts: Turnfile, AIDR, Graceful Boundaries.
Trust the harness, not the AI.
Install it, run a $0 mock, and read the receipts before any key is involved. The safest place to start putting AI to work.