Limited integration
Profile-scoped TUI settings
Five live interface preferences and ten embedded language catalogs. Operator-only controls; localization is incremental, not a fully translated product.
Source
SYSTEMS ENGINEERING FOR AGENTS
Agents think.
Harwness sets
the boundaries.
Turn model proposals into governed work. With explicit authority, durable jobs, and completion that requires evidence.
RUST / LINUX-FIRST / ACTIVE DEVELOPMENT
01 / THE IDEA
Not just an agent.
A system around
its work.
PROPOSAL ≠ AUTHORITY01 / SYSTEM
MODELPropose an action
inputuntrusted input
HARWNESS
01Identity & authorityderive
02Policy & approvalcheck
03Executionbound
04Result & evidencerecord
within authorized scope
FilesProcessesNetwork
CONCEPTUAL PATH · NOT A LIVE DEMO
Harwness is a Linux-first systems project for agents that research, write code, and carry out operational work.
A model can propose a next step. Whether that step is authorized, which resources it receives, and when its work counts as complete are separate questions. Harwness anchors these decisions in a Rust-based runtime.
01
Authority is explicit. Delegation must stay within the parent’s rights.
02
Work has state. Jobs, leases, and cancellation signals extend beyond an individual turn.
03
Success is not a text label. Verification and goal acceptance remain distinct steps.
02 / FROM INTENT TO EVIDENCE
Four layers.
One chain of responsibility.
Definition, authority, execution, and evidence are distinct responsibilities. Select a layer to see how it is grounded in the source.
Implemented in source
harw-agent-compilerAgents are defined.
Not just described.
Layered TOML definitions become a typed intermediate representation. Eight ordered compiler passes validate or resolve roles, rights, skills, reachable tools, models, and child definitions.
TOML→Typed IR→8 compiler passes→Artifact
A content hash binds the definition. It proves neither the author’s identity nor the safety of execution.
Read the compiler pipelineImplemented in source
harw-authorityA prompt is
not a permission.
The runtime derives authority from trusted configuration and the entry point. Child contexts intersect permissions, network scope, and write scope with the parent’s constraints.
Model providers and authority remain separate. A different channel or a more capable model does not automatically receive additional rights.
Trace authority derivation and narrowingImplemented in source
harw-runtimeWork is executed.
And supervised.
RuntimeAssembly connects profiles, approvals, tools, and model providers. Durable agent jobs use a shared ledger with leases, fencing, heartbeats, and cancellation signals.
WorkIdunique work identity
Lease + Fencingbounded execution ownership
Cancellationexplicit cancellation
Not every nested continuation is durably resumable yet. Inline handoffs, in particular, have documented limitations.
Inspect durable job wiringDeliberately limited integration
harw-plan-bridge“Done” is a proposal.
Not its own proof.
The WorkDriver coordinates bounded work waves and centralized verification. Adaptive intent cycles journal effects before dispatch and escalate uncertain outcomes instead of blindly repeating them.
Work→Verification→Completion proposal
The approved intent recipe is currently read-only. Human goal acceptance remains a separate step in the WorkDriver.
Inspect the cycle runtime and its limitsConceptual view of the linked source revision. This is not a running agent or a runtime measurement.
03 / BOUNDARIES NEED MORE THAN INTENT
Not just
“may I?”
But also:
“under which
conditions?”
Authority and isolation are different layers.
The strongest implemented Linux job path combines cgroups, Bubblewrap, and an inner executor. The executor verifies its execution context and applies Landlock, resource limits, and reduced privileges, among other controls.
- 01Outer job executorcgroup membership before launch
- 02Bubblewrapnamespaces and restricted mounts
- 03Inner job executorLandlock · rlimits · NO_NEW_PRIVS
- 04Jobexecution within verified constraints
Requested does not mean enforced. The host, backend, and policy determine which controls are actually available. Required jobs are intended to fail when requirements cannot be met; BestEffort is not equivalent. Darwin does not offer Linux isolation parity.
Inspect the Linux composition04 / DEVELOPMENT STATUS
Clear about
what exists. And what does not.
Here, implemented means present in the inspected source. It is not a claim of production readiness, independent testing, or demonstrated security.
Implemented
Provider tool-turn continuity
Responses handling retains identity-bound empty tool rounds and permits ordinary identity-less, non-reasoning tool results. Encrypted reasoning keeps strict identity checks.
SourceImplemented
Agent compiler
Typed IR and eight validation and resolution passes. Roles and rights are checked before artifact creation.
SourceImplemented
Runtime & durable jobs
Shared RuntimeAssembly, ledger, leases, fencing, and cancellation. No blanket guarantee for every nested resumption.
SourceImplemented
Linux job isolation
Composed execution chain with explicit enforcement reports. Requirements depend on the host and available backend.
SourceLimited integration
Adaptive intent cycles
Persistence, resumption, and evidence-bound progress are present. The approved recipe is currently read-only.
SourceLimited integration
Exact-file writer
The new pilot creates review artifacts rather than checkout changes. This does not restrict all existing coding paths.
SourceLimited integration
Harw-DoD · host observation
Optional eBPF sensors capture process events and TCP connection attempts. Privileges, sensor losses, and coverage gaps remain relevant.
SourceIntegration open
Warden authorization
A signed protocol exists as a library, but is not wired end to end into the inspected Warden binary.
SourceEvaluation open
Measurable system guarantees
This overview provides no new benchmarks, independent security validation, or confirmed production results.
ContextSource revision: 30 Oct 2026, 05:02 UTC · Checked against dev: 30 Oct 2026, 06:47 UTC · Open items are not dated release commitments.
05 / TRACEABLE, NOT JUST CLAIMED
Go one layer deeper.
A useful explanation stays verifiable. This overview links to a fixed repository revision, not a moving branch.
01 / SOURCE SNAPSHOT Read the source
Explore
Look up
Read the source
for yourself.
Repository and architecture at 14082d16. Workspace version 0.10.0 (upcoming), Rust edition 2024.
Explore
dependencies.
The existing interactive crate explorer is preserved. Its data reflects v0.3.0, not the current snapshot.
Open the historical explorer03 / PRESERVED DOCUMENTATIONLook up
the background.
The earlier technical documentation, preserved and clearly marked as a historical snapshot.
Open the documentation archiveWhat this page establishes.
A source-grounded account of selected mechanisms. Neither the full Rust workspace nor privileged host services were newly built, run, or independently audited for this overview. Implementation, integration, and evaluation remain distinct claims.
Research drafts and plans are not treated as completed features. The latest merge records maintainer-reported local validation; this website update does not reproduce those runs or establish successful remote CI. Read the merge record.
Is Harwness a language model?
No. Its focus is the systems layer around model-assisted work: definitions, runtime, rights, jobs, and evidence. Choosing a model provider is a separate decision and grants no additional authority.
Is this a finished production platform?
Harwness is in active development before version 1.0. Interfaces and configuration may change. Existing code is not the same as verified production readiness.
How can I inspect the project?
Start with the README at the pinned revision, follow the source links on this page, and inspect the conditions of each execution path. The earlier website is preserved in the overview archive .
HARWNESS / ACTIVE DEVELOPMENTMore room to act.
Explore the project on GitHub