Shippers.

shippers ecosystem · field note 01 · rev 3

agent /
harness
engineering

revised aug 2026 · loop, then graph, then harness · the model is rented, the harness is owned

rev 1 taught you to stop prompting and build the loop. rev 2 buried the word. rev 3 is the part that lasts: the model is a component you rent by the token, and everything you own around it is the harness. that is the job now, and it has a name, a vendor, and a leaderboard.

build it. ship it. move on.

scroll
prompt context loop graph harness

the shift

prompt → context → loop → graph → harness

  1. 01

    prompt

    write the right words for one turn.

  2. 02

    context

    control what the model sees each turn.

  3. 03

    loop

    design the system that decides the turns and keeps it running.

  4. 04

    graph

    wire the loops into an org and route between them in code.

  5. 05

    harness

    everything you own around the model you rent: tools, gates, memory, evals, telemetry, and the human at the edges. the outer ring is the only one that ever shows up on an invoice.

the first four rings are techniques. the fifth is an asset class. techniques get renamed every six weeks. assets get valued.

the definition

a harness is everything you own around a model you rent

the eight layers from agent-stack, unchanged since you wrote them in july. what changed is the framing: this is not scaffolding you build to get to the model. this is the product. the model is the part that gets swapped when the invoice or the leaderboard moves.

modelrented. swappable by config. opus for the hard legs, sonnet mid, haiku for the handoffs. never named in copy, never load-bearing in code.rented
harness promptrole, context, constraints, done-when. loaded at boot, versioned in git, tested by the evals below.owned
toolsthe mcp surface. the agent cannot act outside it, which is the whole safety story in one line.owned
commsits own inbox, its own number. agentmail, twilio. it transacts, it does not just observe.owned
memorysupabase rows and a lessons ledger the agent reads before it acts and writes after it fails. compounds across runs.owned
gatebetween intent and action: confidence threshold, a closer, and a human at the edges. a gate that can close must have a re-open path. see the fuel line below.owned
loopexplicit done-when, stopping rules, a cost cap, warm handover on kill.owned
watchdogheartbeat and standup. quiet equals not finished. the oracle reads this row, not the agent's own claim.owned
evalsnew in rev 3, promoted from footnote to layer. a golden transcript suite with a budget table and a zero-skip ci gate. the harness is only real once a seeded regression turns it red.owned

the real lever · benchmarking

the score is the model times the harness

score = model × harness

every public leaderboard measures a model inside somebody else's harness. the number you are shown is the product, and you only rent one of the factors. so when two teams run the same model and land twenty points apart, the gap is the harness, and the harness is the only factor you can engineer on a tuesday evening.

/ implication 01

never buy on the leaderboard

a model that wins in a vendor's harness may lose in yours. score it inside your own evals before you switch. the eval suite is the procurement department.

/ implication 02

the harness is the moat

two clinics, an electrician and a broker are not paying for a model. they are paying for the gates, the memory, the number that answers, and the human who signs. none of that is rented.

/ implication 03

a model swap is a config change

if a rename in the model id can take the fleet down for sixteen days, the harness is not finished. it happened. the flat cost ticker was the canary. it is a test now.

the sdk moment · aug 2026

the harness has a vendor now

the agent sdk ships the inner loop as a library: sessions, tools, hooks, subagents, mcp, skills. the loop you hand-built in june is a function call in august. that is not a loss. it moves the work up one ring, to the part that was always yours: which tools, which gates, which memory, which evals, and who signs. you build the harness. they run the loop.

harness.ts · the shape, not the vendor's docs
// the loop is rented. every line below is owned.
const run = query({
  prompt: brief,                          // harness prompt · versioned
  options: {
    allowedTools: surface("outreach"),   // tools · the agent cannot leave this list
    mcpServers: { supabase, agentmail },  // comms + memory
    hooks: {
      PreToolUse:  [gate({ closer, threshold: 0.8 })],
      PostToolUse: [ledger(), heartbeat()],
      Stop:        [verifyBeforeDone()],   // a bare "done" is refused
    },
    maxTurns: 40, maxBudgetUsd: 2.50,      // stopping rules
  },
});
// then the only test that matters:
await evals("outreach").expectRedOn(seededRegression);

hooks are where the enforcement triad lives now: the gate before the action, the ledger after it, the verifier before the claim. that is the same triad agent-stack wrote in july, running inside somebody else's loop.

in your bag already · measured 30 aug 2026

five harnesses, one console

oracle

the console reads the harness, not the agent

cloudflare worker, durable objects, its own instruments. it paints from the heartbeats table and ci, never from an agent's own claim. today: ci 4 of 4 green, 260 of 261 findings resolved.

heartbeats → instruments → one pane

strydeoutreach

a fleet with an eval gate

researcher, closer, concierge, long-game. 135 sends all-time, 12 this week. evals merged as pr #53: 25 scripted prospects replayed through the real generator and the real qa gate, 6 seeded regressions each caught red.

world → scenarios → budget table → zero-skip ci

ava

the war room

330 personas, gate passed at 99% with zero p0. a voice receptionist that has to be right on a phone line, tested like it. the one place where the harness earns its keep on every call.

persona → call → transcript → judge

sentinel · coordinator

the agent that watches the agents

heartbeating every 13 hours, 1 finding open. it also holds the billing guard, which is where the next section starts.

watch → match → act · 6 of 6 beating

customs

the structural review

weekly self-heal, digest on monday, urgent on fail. the thinnest eval surface of the five, so it is next in the queue after oracle.

review → digest → candidate pr, never auto-merged

the lesson of the month · 25 to 30 aug

an agent paused an agent for five days over three dollars

sentinel's billing guard saw $3.31 against a $0.62 baseline and flipped sending_enabled to false. correct. then nothing re-opened it, nothing told you, and the sender's log said "paused by operator" regardless of who paused it. outreach was dark for five working days and the thing that found it was a health check on this site. the harness worked exactly as written, which is the problem: it was written asymmetric.

rule / symmetry

a gate that can close must be able to open

every automatic stop gets an automatic review: a re-check window, an owner, and a notification that names the actor. if the guard can flip the row, the guard files the finding.

rule / provenance

read updated_by, never the log prose

the row knows who paused it. the log said "operator". when the harness can act on itself, actor is data, not narrative. pr #54 fixed the line; the rule outlives the fix.

this is what harness engineering is: the model never touched this bug. the bug lived entirely in the parts you own.

frontier six · where it stands

evals are the infrastructure

the six-item roadmap, in its own order. one finished. one two agents deep. four with a single scoped step each, sized to a friday, not a quarter.

01 evalsava and outreach live with zero-skip gates. next: oracle, then customs. copy the golden-transcript shape, do not re-derive it.2 of 5
02 war-gamesdone. 330 personas, 99%, zero p0. open p2: a spanish-only caller detaches from tool output.done
03 telemetryone span tree on one path: the ava call, carrying outcome and cost. answer one question: what did a booking cost.not started
04 durable executioncheckpoint the outreach generator per touch, not per prospect, so a mid-run kill resumes at touch 3. no new platform.not started
05 computer useone closed loop where the model decides the click: can a new clinic finish onboarding, against demo mode only.not started
06 distilled modelsmeasure first. score classifyintent against its own logged history, record cost per 1k calls. then decide.not started

rev 3 · the rename map

the gaps keep shrinking

prompt lasted thirty months. context, twelve. loop, six weeks. graph, about six more. harness is the first name that describes an asset rather than a technique, which is why this note bets it lasts, and why the bet does not matter. the practice was never the word.

~30 months ~12 months 6 wks 6 wks ? prompt2023rip contextmid 2025rip loopjun 2026rip graphjul 2026rip harnessaug 2026 next

for the timeline · four lines that travel

say it short

01

the model is rented. the harness is owned.

everything on the invoice is a component. everything the customer pays for is the harness.

02

a leaderboard scores a model inside somebody else's harness.

same model, twenty points apart, and the gap is the only factor you can engineer.

03

a gate that can close must be able to open.

an agent paused an agent for five days over three dollars. the model never touched the bug.

04

the harness is only real once a seeded regression turns it red.

green is the start. red on purpose is the proof.

routing · from wk 31 aug

bupa days are not build days

three shifts a week fund the floor. the harness runs itself on those days, and the console proves it without you. friday is the build, saturday morning is the lab, and the only harness work that fits in a weekday seam is reading a row, never writing one.

the note in one breath

you rent the model. you own the harness. the harness is the gates, the memory, the evals, the watchdog, and the human at the edges.

every rename since 2023 has been a new name for one more ring of that. build the ring. let them name it.

build it. ship it. move on.

shippers ecosystem · field note 01 · rev 3 · aug 2026 · rev 2, loop engineering, kept as written · the production stack · leverage · shippers-tt