coulomb/glas-harness
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
Agent harness platform and meta framework.
70 commits 1 branch 0 tags 509 KiB
Find a file
codex a95691b0ac
All checks were successful
ci / validate (push) Successful in 2m6s
Details
docs(agents): repoint remote State Hub URL to the in-cluster address 
The remote row pointed at 127.0.0.1:18000, a reverse tunnel back to the
workstation. On railiance01 the State Hub runs in the cluster on that same
machine, so the request left the box and came back to reach a local service.

Refs CUST-WP-0067-T07

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 2583210@bnt-lap001
Assistant-Session: f2bff2d5-e9b2-4338-92ca-10282a927006
2026-08-25 00:21:01 +02:00
.forgejo/workflows fix: enforce sandbox execution boundary 2026-08-21 10:40:29 +02:00
docs Harden SSH and profile resolution boundaries 2026-08-23 12:53:05 +02:00
examples Make profile runtime readiness explicit 2026-08-23 11:32:23 +02:00
history Make profile runtime readiness explicit 2026-08-23 11:32:23 +02:00
profiles Make profile runtime readiness explicit 2026-08-23 11:32:23 +02:00
registry feat: add versioned execution profiles 2026-08-21 00:21:53 +02:00
research A list of kings names 2026-08-20 16:50:00 +02:00
src/glas_harness Harden SSH and profile resolution boundaries 2026-08-23 12:53:05 +02:00
tests Harden SSH and profile resolution boundaries 2026-08-23 12:53:05 +02:00
workplans chore(registrar): assign State Hub identifiers 2026-08-23 12:54:19 +02:00
.custodian-brief.md chore(consistency): sync task status from DB [auto] 2026-08-22 23:53:46 +02:00
.gitignore Implement the harness contract and prove it against rein-aharness (GLAS-WP-0001-T02/T03/T04) 2026-07-26 13:02:59 +02:00
.repo-classification.yaml Initial commit 2026-06-22 19:22:49 +00:00
AGENTS.md docs(agents): repoint remote State Hub URL to the in-cluster address 2026-08-25 00:21:01 +02:00
INTENT.md feat: add versioned execution profiles 2026-08-21 00:21:53 +02:00
LICENSE Adopt Target Revenue Source License V1C1 (org-wide preliminary rollout) 2026-07-30 00:17:57 +02:00
pyproject.toml fix: enforce sandbox execution boundary 2026-08-21 10:40:29 +02:00
README.md Make profile runtime readiness explicit 2026-08-23 11:32:23 +02:00
SCOPE.md Make profile runtime readiness explicit 2026-08-23 11:32:23 +02:00
WORK-RECORDS.md Harden SSH and profile resolution boundaries 2026-08-23 12:53:05 +02:00

README.md

glas-harness

glas-harness is the primary execution-layer abstraction for governed agent work. Consumers select a versioned Glas profile; Glas resolves the concrete rein, model route, sandbox profile, tool policy, and limits, runs the outer lifecycle, and returns one normalized evidence envelope.

The consumer contract does not name a Python rein class or provider CLI:

assignment / channel / activity
  -> ExecutionRequest(harness_profile_ref=...)
  -> Glas profile resolution
  -> rein + model + sandbox + tool policy
  -> normalized ExecutionEvidence

Profiles

List and validate every committed catalog profile, including its independently declared runtime readiness:

glas-harness profiles
glas-harness profiles --json

Current constellations include:

  • harness.agent-dev-local@1.0.0: rein-aharness, Claude Code model route, local bwrap sandbox.
  • harness.agent-dev-openweights-local@1.0.0: rein-openweights, OpenRouter open-weight route, local bwrap sandbox.
  • harness.agent-dev@1.0.0: rein-aharness, remote agent-dev sandbox.

The two local profiles are currently blocked by the missing sand-boxer owner-execution/runtime path. The remote profile is unverified: it may be used only as an explicitly labeled proof attempt. No committed profile is currently declared ready.

Start a bounded proof attempt through the currently unverified remote profile:

glas-harness run \
  --harness-profile harness.agent-dev@1.0.0 \
  --repo /absolute/path/to/repo \
  --title "Bounded change" \
  --description "Make the requested change and commit it"

There is no governed default rein, model, sandbox, or tool profile. Unknown, disabled, incompatible, ambiguous, and operationally blocked selections are refused before sandbox creation. An unverified selection is allowed so a bounded proof can establish or disprove readiness, and its evidence retains that state.

After creation, execution uses only the reachability-derived sandbox workspace: same-host namespaces are entered with nsenter, while remote workspaces are reached over SSH. The source checkout is provisioning input, not a rein workdir.

See SCOPE.md, INTENT.md, docs/execution-profiles.md, and docs/harness-contract.md.

Development

uv run pytest -q