COLORADO STARTUP WEEK · SEP 14 2026
Build Your Own Harness
for Fun And Profit
How to choose, evaluate, and build harnesses
with explicit guarantees
What you'll get
Sixty minutes buys you
a checklist and a live demo.
Message passing between panes,
live. Then an app the harness
shipped at a hackathon.
One-room calibration
Where does
this room sit?
Why are we doing this?
Agents on a boat.
None of that is a model capability. It needs durable execution and a record you can read from anywhere, which is what the rest of this hour is about.
A gate run finishing. On a reservoir. On a Saturday.Why now
The same model.
Two harnesses.
One model, ARC-AGI-3 Semi-Private.
Standard harness at max reasoning: 62.7%.
Provider adapter at high reasoning: 99.9%.
The adapter kept reasoning state across turns.
Not an AGI claim; one closed,
deterministic benchmark.
The landscape today
You are already choosing.
These are just a few options.
A snapshot, and this moves fast.
First principles
Strip it down.
What is left is the harness.
Every capability you think of as the agent's is something you built, bought or inherited. This is the subtraction to run before you design anything.
A short history · part one
The harness kept
taking things over.
Each row is a responsibility the model could not hold on its own.
A short history · part two
Now it can
improve itself.
Everything before this was a static harness: a spec, a tool list, a skills list, a sub-agent list, in a loop. Past that line the harness starts rewriting itself — recursive self-improvement — and that is where the last year of progress sits.
Adapted from the YC Harness Club history. We build on the static side on purpose. Slides 20 to 22 cover what the other side actually is, and what it costs.
The inventory
A harness is seven-ish authorities
around a shared model.
the model
can't assertthe lens
Governance + recovery constrains every other authority.
The configuration surface
An agent spec fits
on one index card.
Not the whole harness. Execution, verification, observability and governance still need owners.
Adapted from the YC Harness Club agent-spec summary. Write yours at the end.
WHO OWNS THE FACTS
A harness component owns a fact
the model cannot safely assert.
Evaluate every component by asking what guarantee breaks when it is absent.
If the model's claim is the only evidence, the claim is the oracle.
The method, in two questions
Ask capability first.
Then set the authority boundary.
Build the first surface wide. Keep the second surface outside it.
Expressivity without an external boundary becomes unsafe. Authority without expressivity becomes brittle.
Apply the test
Name the fact.
Name the owner.
Five representative authorities. Tools and Execution are covered on the inventory and the execution-boundary slide.
HOT TAKE
Adding every component
is not automatically better.
A component that does not own a guarantee is cost without coverage.
You are here
The vocabulary is built.
Now the decision.
Next: what an off-the-shelf harness already owns for you.
Off-the-shelf
What you get,
what stays shut.
Most people should take the first. Some workloads require the second.
Name the layer
Workers execute.
The harness decides.
If you own a guarantee, this is the layer that holds it.
The control plane
Workers can fail. The control plane must stay authoritative.
Proof object · Orris + Orrisd
Five facts the model
cannot assert itself.
Our split: one product owns sessions and panes, the other owns runs, gates and the journal.
What it is actually built with
Built on the BEAM.
Status column included.
The harness I built, and where each authority actually lives in it.
Parts of the pane layer are still shell scripts; that rewrite is proposed, not shipped. Postgres and Oban are nowhere in the execution path.
Self-improving harnesses
The harness itself
goes in the search space.
What changes is persistent harness state; the weights are left alone. A computation that worked becomes a skill. A coordination pattern that worked becomes a sub-agent spec.
Beyond this: rewriting the harness code, then the weights. Almost nothing that works today goes there. The harness, not the episode, is the transferable unit.
Recursive self-improvement
A harness can only rewrite
itself if four things hold.
When the refiner and the evaluator share a model, the score is evidence, not an independent verdict.
Miss one and you do not have self-improvement. You have drift you cannot audit.
What the stack has to do
Run many variants.
Remember all of them.
One property is not negotiable: the policy that bounds a run must sit outside what the run can rewrite. An optimiser that can widen its own permissions will.
An agent reached a privileged console command despite a check meant to stop exactly that, then saved the workaround as a reusable skill.
Their three controls: least-privilege interfaces · independent state validation · auditable rollback
Prime Agent, arXiv:2608.23552v1, §3.5
Execution boundaries
What can the
worst run reach?
Isolation does not make an agent safe. It makes the damage bounded and knowable. Only the second is something you can design.
Disclosure: this workshop was built with approvals and sandboxing bypassed. A worktree, an external gate and a readable journal are compensating controls, not equivalent isolation.
The failures in this section are execution-boundary failures, not model failures.
One use-case, concretely
Point it at the
lifecycle you already have.
Every step is a place a harness component earns or loses its keep.
What breaks in production
Everyone hits the
same four walls.
The agent deleted a working tool and wrote a replacement whose payload did not match the schema. The harness accepted the malformed call without erroring, recorded it as a success, and repeated it until the loop ended by accident.
What would have caught it: typed tool boundaries · independent validation · a bounded stop path
One repair pattern: lint every tool result, fix it with a cheap rescue model, then keep the error out of context.
Continual Harness, arXiv:2605.09998v1, App. B.3 · None of these are model problems. All four are owned by the harness or by nobody.
You are here
Enough architecture.
Time to show you the layer.
Four commands. Ninety seconds. Everything you see lands on disk.
Demo · the substrate
Two panes. One daemon.
Watch the handoff.
I am not going to demo a finished product, because there isn't one. What is finished is the layer underneath, which is what this hour has been about.
Four commands, ninety seconds. Everything you see on screen is on disk afterwards.
Demo · what the receipt proves
The sender asks.
The daemon decides.
Three parties, and only one of them decides. The capability is mine; the decision is not.
Slide 13 argued this. Slide 14 put it in a matrix. This is it happening, with the receiver's own copy as the proof.
What the substrate produced
One hackathon.
One hour to production.
Pocket Pets, deployed. Built at the Dispersed hackathon.One team, one clock, one app. It is what happened, not a promise about what would happen for you.
Pocket Pets, built for the Dispersed hackathon. These slides are wearing its palette.
Proof slice
Shows what happened.
Steers nothing.
Projections are derived and deletable.
Deleting them changes no execution decision.
Observability failure never edits a journal fact.
Preselected safe view only.
The receipt and the envelope,
not arbitrary inbox browsing.
What this shows
Verification,
not trust.
Verification was the receiver's envelope and the queue state,
not the sender's claim that it sent something.
owned.
Resources
Take the reading list,
not just the slides.
Build with it
Orris local-first workflow orchestrationOrrisd agent coordination runtimeJido Elixir agent framework — built Pocket PetsGuild a control plane for agentsProletariat agent orchestrationautodevThe evidence behind the claims
ARC Prize: Astra 62.7% → 99.9%, same modelWhy the harness matters more than the model YC Paper ClubElixir’s AI Future — Chris McCord ElixirConf US 2025Prime Agent arXiv 2608.23552Prime Agent — write-upContinual Harness arXiv 2605.09998Continual Harness — project pageHow the big ones were built
Building Codex — Tibo SottiauxBuilding Claude Code — Boris ChernyAgentic Mesh Broda & Broda, O’ReillyThe Agentic Mesh PodcastEvery link is clickable. Open what you need, ignore the rest.
Your turn
Define your harness
in three lines.
Stuck? No owner → add the component. Would you notice it failing → instrument it. Can the model assert it safely → let it. Testable → make it a gate.
Close