The Harness

The whole system hangs off one operating contract every agent loads: authority and safety rules, evidence rules, git discipline, engineering standards, delegation law, and cadence. Three properties make it an engineered artifact rather than a prompt. It is budgeted: the contract lives under a hard word ceiling with an exactly pinned reserve, enforced by its own check, so every added rule must pay for itself and evictions are recorded. It is layered: always-resident rules stay in the contract, task-specific procedure lives in pointer files loaded only at their trigger, so every session pays only for the rules its work needs. It is enforced: a rule that matters graduates from prose to a hook or a gate class, because the system's own audits proved that prose alone decays.

Governed repositories carry a gate script that is the machine definition of “done”. Its dozens of classes each encode one specific historical failure: undeclared stubs, silently deleted rules, drifted settings, stale maps, broken budgets, identity violations, missing worklog evidence. The gate runs before any green claim, and its output - not the agent's summary - is the evidence.

The signature discipline. The gate has its own test suite of ~150 controls that attack the system as shipped, not staged examples, and assert that every class actually goes red on the fault it exists to catch. Positive controls prove the checks fire, and expectations are never measured against a broken baseline. The same standard applies to every verification tool in the system: if it has never been watched failing, it is not trusted to pass.

The harness fences what agents can execute: command guards, a deny fence, and protected paths. The part worth hiring for is what happened next. Independent review lanes were cast to break the guards, and they succeeded - repeatedly. Instead of patching each finding and reclaiming strength, the record was corrected to downgrade the guard's claimed strength, and a differential verification was built: continuous measurement of what the enforcement actually catches against what actually executes, so a gap is a red build rather than a silent hole. Defense in depth was then chosen deliberately: the most critical assets gained an independent protection layer that does not depend on the guards at all.

“Done” requires evidence produced this session: fresh command output, file-and-line citations, gate counts. Two separate vocabularies keep claims honest: a lifecycle axis for where a task stands, and a verdict axis for what a check actually said - the two are never fused, so “done” and “verified” cannot be conflated. Filtered output counts as evidence only with a pointer to the unmodified original. Stubs must declare themselves and fail loudly; a passing verdict over an undeclared stub is a false green and is treated like a red gate. User-interface claims require an exercised app or a screenshot, and prototypes are never presented as product.

Every governed repository carries a small set of context files with one owner per fact. The decision ledger is append-only by convention - held by git history, non-author review, and enforcement hooks - and every entry names the rejected fork, why it lost, and the observation that would reopen it, including entries that correct the system's own earlier overclaims, because the record is corrected forward, never rewritten. The worklog is an append-only table keyed by stable task IDs, with lifecycle and verdict in separate columns and evidence as pointers. A stop-hook refuses to end a repo-changing session without its dated worklog line.

The quality half of the system, built on one insight: stale or missing context is the quiet way a clean-window workflow still produces wrong code - the window was clean, but what filled it was wrong. Two generations of tooling implement it: a nested context engine with per-module context files, freshness markers, and a deterministic no-LLM staleness checker; and the flat convention above, with hard budgets and a small fixed set of write triggers - never agent discretion in between. Adherence is measured from the actual commit history, per repository, as a trajectory, and both improving and decaying trajectories are on the record. The quality link is the design thesis the measurement exists to test: the numbers say where the process is holding and where it is decaying, before anyone has to guess.

Sessions run a fixed loop: reconcile, take one scope, build small, verify, review at triggers, land. Decisions the work will force are named and settled before execution, while the session is still context-cheap, because a decision made after the code exists is biased by the code. Bug fixes start by reproducing the bug end to end as a user would hit it, and fixes target the root cause across every caller, not the reported symptom.

Review is mandatory at fixed triggers - non-mechanical plans, experiment designs, the riskiest change of a run, anything safety-adjacent - and a trigger is satisfied only by a reviewer that did not produce the work; the author's own re-read is not a review. Praise for an unverified result triggers refutation framing: assume it is wrong and try to break it. Re-reviews are surgical: scoped to the delta since the reviewed commit plus the implied regression set, re-deriving nothing already confirmed. Proportionality is law in both directions - mechanical work a direct check proves gets no review lane, and a verification run that cannot change a decision is recognized as waste, not rigor.

One session can orchestrate a swarm, under law rather than improvisation. Concurrency ceilings are set per model class and are ceilings, never targets. Known-shape work casts one wide scout that hands exact targets to narrow workers; unknown-shape work keeps blind independent sweeps, because a scout there is a single point of failure for coverage. Workers return uniform packets - claim, evidence, confidence, status - and a failed status is valid data, never an exception to hide. The failure policy is fixed: one re-scope and retry, then a different approach with the failure logged; never a third identical attempt, because fresh eyes beat tired persistence. Model choice is an escalation ladder: the cheaper model is the default for every lane, and a larger model must be earned by evidence and named at cast, so off-default choices are visible rather than habitual. Concurrent writers get isolated worktrees with disjoint file scopes; shared ledgers are written only by the orchestrating thread after the merge.

Spend is modeled monthly from measured token flows against a recorded baseline. The findings drive policy: session defaults were lowered when the data showed the pinned default, not the work, was driving cost; sessions are closed before going idle because a cold resume re-uploads the whole context; ingestion is capped at the call site because every token pulled in is re-sent on every later turn. Every efficiency rule names its control when it lands, and is dropped at reconciliation when the data shows it stopped paying - rules that expire rather than accumulate.

The harness treats operator input as an engineered interface too. Dictated braindumps are parsed under fixed rules: transcription artifacts identified, multiple threads split and tagged as orders, questions, or parked ideas, musings distinguished from orders, and destructive requests echoed as exact target lists awaiting one word - because the most dangerous failure mode of a capable agent is confidently executing what the human almost said.

The environment reproduces across machines, at both machine and user scope, idempotently, with pinned tools installed from a manifest. Repositories travel between devices as verified bundles, with onboarding through recorded handoffs, never ad-hoc copies. Commit identity is enforced fail-closed: a machine missing its enforcement refuses to commit rather than committing unenforced. Canon-and-copy law keeps multi-device truth coherent: a file's canonical copy declares itself canon in its own header, every other copy names its canon, and backups are refreshed by re-copy, never edited. A single map file is the first thing a cold agent reads: the component table, each component's home and governance, and a formal intake for how a new concept enters the system at all.

The system maintains an explicit honor list: which guarantees are machine-enforced, and which still rest on an agent remembering - each honor residual named with an owner. Its context system has been formally audited three times with quantified verdicts; roughly half the findings landed, and the remainder is tracked open on the record rather than forgotten. The harness itself has been penetration-tested by adversarial agent lanes: 22 findings, 12 confirmed by actually executing the attack, and every confirmed finding closed with a regression control so it can never silently return. The finding that shapes everything: machine-enforced rules held everywhere, and everything resting on honor decayed on a predictable gradient. The response is the system's engine of improvement: observed decay drives mechanization, every incident becomes a regression control, and the record is corrected in public when a claim was too strong.