Put AI to work without giving up control.
Harnessie is an AI harness: the layer of guardrails between you and a language model. It lets the model do real, multi-step work while keeping you in charge, so nothing runs that you did not allow and nothing is called done until it has been checked.
New to this? That is exactly who it is for. You do not have to trust the AI; you trust the harness around it. And when you want more, the same setup runs a small model on your laptop or the most capable one available, by changing a single line.
What a harness is, and why you want one
An AI model on its own is capable but unsupervised. It can act before you approve, report a task finished when it is not, or reach for things it was never meant to touch. A harness is the structure you put around it. It sets what the AI is allowed to do, checks the work before moving on, and records everything that happened. You get the model's ability without handing over the keys.
That is the idea in the name: you do not tame something powerful, you harness it, so its strength goes where you point it and stops where you say.
Harnessie is built to be the first harness you reach for, and safe enough to stay your default: honest about what it did, easy to inspect, and the same whether a small local model or a frontier one is doing the work.
What you can count on, every run
It asks first
The AI cannot change a file or run a command until you have allowed it. An offer it declines is recorded, not overridden.
It checks its work
Nothing counts as done until a separate, independent step confirms it against clear criteria. "It said it worked" is never enough.
You have the final say
When there is a real judgment call, the run stops and waits for a person. The machine never makes that decision for you.
It keeps the receipts
Every action, by the AI or by you, is written to a record you can read back and cannot quietly alter.
How it works
Harnessie splits a job across three kinds of agent and puts a checkpoint between every step. An orchestrator plans, breaking your goal into small tasks with clear success criteria. Workers do the tasks, one at a time, inside a sealed workspace where they can only touch what they created. A verifier checks each result on its own, without seeing how the worker got there, and can only pass or fail it, never wave it through.
In precise terms: the orchestrator runs at high effort and emits task packets with out-of-scope fences; workers consent before any side-effecting tool unlocks; every worker phase exits through a gate that runs deterministic checks first, then an independent fresh-context verifier that fails closed; contested decisions fan out to an adversarial panel whose objections land in a decision record only a human may arbitrate.
Structured by default
Consent before side effects, a deterministic-checks-plus-verifier gate that fails closed, and per-agent file ownership. The structure holds the quality floor no matter which model runs underneath it.
Brain-agnostic
A frontier orchestrator, cheap workers, and local open-source models via any OpenAI-compatible endpoint. Swap any tier by editing one YAML file; the gates, jails, and budgets never change. Four providers have already produced verified work under it (the receipts).
Auditable
Every run is journaled, budgeted, resumable, and hash-chain audited. One composite timeline records agent and operator actions; tampering breaks the chain.
Quick start
This part uses a terminal. If that is new to you, it is a friendly place to start: every command below is safe to run, and nothing reaches the network until you choose to add a key.
Requires Python 3.11 or newer and PyYAML. The model adapters are standard-library, so no vendor SDK is needed. The test suite and the eval scorecard run against a deterministic mock brain with no network, so you can prove the harness works before any API key is involved.
Install and run
git clone https://github.com/snapsynapse/harnessie.git cd harnessie pip install -e ".[dev]" python3 -m pytest -q # mock brain, offline python3 -m harness.cli eval # deterministic scorecard export ANTHROPIC_API_KEY=... # or a local endpoint python3 -m harness.cli run \ workflows/build-and-verify.yaml \ --goal "a CLI todo app with tests"
Swap the brain
# config/models.yaml is the ONLY file
# you edit to change models.
tiers:
frontier:
provider: anthropic
model_id: claude-fable-5
local: # open-source, offline
provider: openai-compat
model_id: qwen3.6:35b-mlx
base_url: http://localhost:11434/v1
routing:
plan: { tier: frontier, effort: high }
implement: { tier: local, effort: low }
Point task classes at any tier. The harness does not change.
How those guarantees are enforced
The promises above are not policy or good intentions. They live in code at the tool layer, where no prompt can switch them off. The mechanisms are the product, not a wrapper around it.
| consent | Task packets are offers. Side-effecting tools stay locked until a worker accepts; declining is first-class and never punished. |
| ownership | Agents own the files they create and cannot write each other's; operator lanes are locked to every agent. |
| sandbox | Every child command runs in an OS confinement (Seatbelt on macOS; bubblewrap, firejail, or docker on Linux) that denies writes outside the workspace and denies network by default. No usable backend means shell fails closed. |
| quarantine | Tool results and inter-phase reports are scanned for injection and invisible characters, then fenced as data-not-instructions before a model sees them. |
| refusals | Every denial is a machine-readable refusal and a logged audit event: actionable for the model, legible for the operator. |
| contests | Decisions fan out to an adversarial panel; dissent halts the run and writes a decision record only a human may arbitrate. |
Five habits, made enforceable
Everything in that table is the codified form of five engineering habits, each proven separately in the author's other tools and standards before it landed here as code: deterministic checks run before any model judgment (the gate order); evaluation comes before implementation — a governance mechanic without a red-then-green scenario pair does not merge (EVALS.md); remembered facts carry verified and verify-by dates and expire visibly, never silently (GOVERNANCE.md); every agent and operator action lands in one hash-chained, tamper-evident timeline (threat model); and any control that cannot be enforced fails closed rather than running unenforced (SECURITY.md). The same habits produced the standards Harnessie adopts — Turnfile, AIDR, Graceful Boundaries — which is why they fit together.