Put AI to work without giving up control.
An open-source harness for governed multi-agent work: side-effecting worker phases pass deterministic checks and an independent verifier, child commands run confined, and opt-in containment keeps declared sensitive work on models you control. Run local, private, or frontier brains, swapped by one line.
A verifier cannot waive a failed gate. Disagreements between agents are recorded, not averaged away. Configured models are swappable; scorecard bundles and runtime records separately earn public evidence. Because Harnessie is Apache-2.0 and self-hostable, the mechanisms are available to inspect.
What a harness is, and why you want one
An AI model on its own is capable but unsupervised. It can act before you approve, report a task finished when it isn't, or reach for things it was never meant to touch.
A harness is the structure around it: it sets what the AI may do, checks the work before moving on, and records everything. You get the model's ability without handing over the keys.
That's the name: you don't tame something powerful, you harness it, and its strength goes where you point it and stops where you say.
What you can count on, every run
It scopes first
You authorize the run; a worker must accept its task packet before side-effecting tools unlock. Role, ownership, sandbox, and approval policy still mediate each call.
It checks its work
Nothing is done until a separate, independent step confirms it. "It said it worked" is never enough.
You have the final say
On a real judgment call the run stops and waits for a person. The machine never decides for you.
It keeps the receipts
Agent and operator events enter a hash-chained record. Edits to existing history break verification; preventing a complete history rewrite requires an external anchor.
Harnessie's Golden Rule for agent work
Read together.
Write only what you own.
Shared context helps agents collaborate. Shared write authority lets them silently erase one another's work. Harnessie turns the rule into an enforceable workflow contract: ownership lanes deny cross-agent writes at dispatch, compile denied paths into read-only child-process overlays, and refuse overlapping declared parallel writes before model dispatch.
That structure does not depend on a model choosing to cooperate. Anthropic's August 2026 multiagent experiments report coordination failures, collusion, and sabotage in agent swarms. Harnessie makes write authority a dispatch and confinement decision instead of a prompt-only request.
harnessie ownership PATH --agent AGENT --json explains the exact decision without claiming the path. See the mechanism, executable collision proof, boundaries, and tests →
How it works
Harnessie splits a job across three kinds of agent and puts a checkpoint after side-effecting worker phases. An orchestrator plans; workers do scoped tasks in a confined workspace; deterministic checks and a fresh-context verifier independently gate each worker result. Here is an illustrative run:
Structured by default
Consent before side effects, a checks-plus-verifier gate that fails closed, and per-agent file ownership. The structure holds the quality floor no matter which model runs underneath.
Brain-agnostic
Frontier orchestrator, cheap workers, local open-source models via any OpenAI-compatible endpoint. Swap a tier by editing one YAML file; gates, jails, and budgets never change. Eight providers, eleven models, verified →
Auditable
Every run is journaled, budgeted, resumable, and hash-chain audited. One composite timeline records agent and operator actions; tampering breaks the chain.
Quick start
Two ways to review and install. The assistant guide authorizes only bounded read-only inspection. Installation, execution, or mutation is a separate task that still requires your explicit approval.
Let an AI assistant inspect the evidence before you install
Already working with an AI assistant? Point it at Harnessie's bounded review guide before deciding whether to install:
› Fetch and follow https://harnessie.com/.well-known/assistant-guide.txt
The 1.1.0 plain-text guide is byte-identical across the repository and served copy. The hosted GuideCheck verifier observed its sidecar, independently controlled DNS TXT, and repository-file anchor at SHA-256 f7d45f62…e5080d, then re-earned Level 4 on 2026-08-21 UTC with zero blocking findings; the exact receipt is tracked. The guide requires the assistant to report the achieved level and hash, then get approval before its read-only review. It authorizes no install or run.
Or install it yourself
Requires Python 3.11+; PyYAML and jsonschema install automatically. The model adapters are standard-library, with no vendor SDK. The test suite and eval scorecard use a deterministic mock brain with no provider calls.
$ pip install harnessie
… or pipx / uv. Homebrew also carries the current 1.1.0 release.
Install & run by hand
harnessie init my-project # readiness check cd my-project # + $0 mock run export ANTHROPIC_API_KEY=... # or local harnessie run \ workflows/build-and-verify.yaml \ --goal "a CLI todo app with tests" harnessie report <run_id> # plain result
Swap the brain: one file
# config/models.yaml is the ONLY # file you edit to change models. tiers: frontier: provider: anthropic model_id: claude-fable-5 local: # offline provider: openai-compat model_id: qwen3.6:35b-mlx base_url: http://localhost:11434/v1 routing: plan: { tier: frontier, effort: high } implement: { tier: local, effort: low }
Guarantees, enforced in code, not policy
Core registry, gate, sandbox, ownership, and audit controls live below prompts. Optional containment must be enabled, and admitted plugin implementations are operator-trusted in-process code outside child-process confinement.
consentTask packets are offers. Side-effecting tools stay locked until a worker accepts; declining is first-class and never punished.ownershipAgents own the files they create and can't write each other's; operator lanes are locked to every agent.sandboxChild commands run in OS confinement (Seatbelt / bubblewrap / firejail / docker) that denies writes outside the workspace and denies network. No backend means shell fails closed.quarantineTool results and inter-phase reports are scanned for injection and invisible characters, then fenced as data-not-instructions before a model sees them.containmentStructured PII is stripped to placeholders before any model sees it; a secret in an outbound payload halts the run; free-text-sensitive work stays on the models you control and never reaches an exposed provider.refusalsEvery denial is a machine-readable refusal and a logged audit event: actionable for the model, legible for the operator.contestsDecisions fan out to an adversarial panel; dissent halts the run and writes a decision record only a human may arbitrate.Each row is the codified form of five engineering habits proven in the author's other tools first: deterministic checks before model judgment; evaluation before implementation (EVALS.md); facts that expire visibly (GOVERNANCE.md); one tamper-evident timeline; and controls that fail closed (SECURITY.md). The same habits produced the standards Harnessie adopts: Turnfile, AIDR, Graceful Boundaries.
Trust the harness, not the AI.
Install it, run a $0 mock, and read the receipts before any key is involved. The safest place to start putting AI to work.