Understand
the harness.

Harwness runs language-model agents as supervised work. Models produce intents; Rust components own authority, execution, and durable state.

Build and run locally.

From a checkout of the project, use a Rust toolchain compatible with the workspace and its locked dependencies. The manifests declare Rust 1.85 and edition 2024. Linux is the primary environment for process isolation and DoD.

cargo build -p harw-cli
cargo run -p harw-cli -- init
cargo run -p harw-cli -- onboard
cargo run -p harw-cli --

init scaffolds the local home; onboard configures a provider and model. With no subcommand, harw opens the terminal client. Model inference follows the configured provider; a local runtime does not imply offline inference.

harw doctor
harw settings
harw --resume
harw analyze --dry-run
harw --help

Keep credentials in supported secret stores or environment references. Project-local configuration contributes a layer only after explicit project trust. Use harw project trust . for a project you have inspected.

Definitions become executable contracts.

The agent DSL parses TOML, resolves configuration layers, validates authority, and lowers the result to ExecutableAgentIr. A versioned BLAKE3 snapshot identifies the compiled definition.

Definitions include roles, specialization, admitted and forbidden tools, spawn budgets, context programs, lifecycle rules, and return contracts. Derived definitions narrow the authority inherited from their base.

schema = "harwness.agent/v1"
id = "example.agent.explorer@1"
version = "1.0.0"
role = "worker"
specialization = "explorer"
name = "Explorer"
description = "Read-only workspace exploration."

[tools]
admitted = ["fs.read", "fs.list", "fs.search"]
forbidden = ["fs.write", "shell.exec", "web.fetch"]

[spawn.budget]
max_tokens = 60000
max_tool_calls = 40
max_wall_secs = 180

The closed role set distinguishes UserInterface, RootOrchestrator, ChildOrchestrator, Worker, UiaWorker, and AgentSteward. Specialized definitions cover exploration, research, planning, implementation, memory, and security triage.

Compilation alone grants no host capability. Runtime assembly and the tool execution boundary still determine what an instance can do.

A prompt cannot grant permission.

harw-authority separates requested permissions from granted authority. ToolExecutionContext carries the runtime-established sandbox alongside untrusted tool arguments. Approval composition is conservative: deny outranks ask, which outranks allow.

Secrets include hybrid post-quantum envelope mechanisms through the pinned crypt_guard dependency. This describes an implementation choice, not a certification or a blanket security guarantee.

The goal outlives the context window.

harw-plan owns goals, plan nodes, dependencies, scopes, and evidence. harw-plan-bridge reconciles findings with plans and translates executable nodes into jobs. Read-only research can fan out; mutations stay attached to explicit work scopes.

harw-job-runtime supplies budgets, leases, retry policies, and stored job types. The running executor is composed above that layer, including the CLI job worker and the core durable runner.

Transcripts and job records live in the session store. Project-memory wiring captures tool outcomes, flushes and consolidates at session close, and can sweep leftover candidates on startup. Curated knowledge—memory, diary, workbench, kanban, and dream-related artifacts—has a separate store with visibility and promotion boundaries. These artifact types do not imply a complete user interface for every surface.

Evidence with provenance.

Lens separates chunking, persistence, embeddings, indexing, queries, and federation. Markdown, Rust, and plain-text chunkers feed content-addressed storage. Exact vector search and BM25 supply candidates; ranking and packing fit relevant evidence into a budget.

Queries check visibility and embedding provenance. Federation queries multiple compatible indices and reports skipped sources. The model-facing lens.ask tool is wired into the planning registry profile.

One core. Provider-aware execution.

The core consumes a model-provider contract. Concrete HTTP adapters implement Responses, Chat Completions, Anthropic, and Codex paths, preserving provider-specific reasoning and tool-call behavior.

The model catalog separates declared capabilities, runtime profiles, provenance, and observed behavior. Embedded provider data works without a catalog refresh; optional models.dev enrichment supplements it. Internal tasks can have their own configured model selection.

Retries, rate limiting, context limits, and cache strategy live in explicit components. Catalog entries and seeded behavior scores are not independently verified performance benchmarks or a promise that every provider combination is supported.

Observe broadly.
Authorize precisely.

DoD is a separate 32-package Cargo workspace with its own build configuration and lockfile. Its sensors, analysis, privileged probes, and enforcement process have distinct responsibilities.

Sensor availability depends on Linux facilities, build features, capabilities, and deployment configuration. Service/CLI migration is incomplete across DoD binaries; this snapshot is not a fully integrated host-defense deployment. Imported scanner reports are read from disk; the report sensor does not launch a vulnerability scanner.

Telemetry includes a file sink plus opt-in Prometheus and OTLP export paths. Security and Warden observations have additional routing restrictions.

Connected does not mean equally privileged.

These are the base ceilings in EntryKind::profile. Definition, scope, mode, and approval checks can restrict them further. Separately governed grants must be inspected on their own paths.

Telegram requires opt-in configuration and pairing. Web operations use Unix-socket peer credentials. The MCP listener validates protocol and session ownership before handing submitted work to the durable supervisor.

Capabilities, with their conditions.

This overview is grounded in the supplied source snapshot. Package relationships are statically inspected; the full Rust workspace and privileged host services have not been built or executed as part of this website work.