Agent harnesses
How coding harnesses plug in through the authorexecutor port while Numinance keeps authority over every action.
The authorexecutor port is a public contract. The adapters that implement it for specific harnesses are designed, not shipped.
The harness owns intelligence. Numinance owns authority.
Executor explorer
Harness adapter explorer
When the executor changes, what stays fixed?
- Policy decisionevaluated outside the model before every privileged action
- Grantcapabilities, allowed and denied paths, budget
- Credential brokerhands out handles, never key material
- Egress proxyonly the allowed destinations
- Protected pathspolicy, CI definitions, IAM, workflow files
- Review and release identityno self-approval; only the release pipeline deploys
A Go adapter drives the harness over its own JSON-lines protocol inside the work-unit sandbox; the harness keeps its own planning and tools.
Example manifest: public specFrom the published example ExecutorManifest claude-cli-bedrock.
Frame unchanged: 6 of 6. Swapped: harness layer, capability manifest, model route.
- TOOL_INTENTharness claim
- POLICY_DECISIONhost-recorded
- TOOL_DENIEDhost-recorded
- TOOL_RESULTharness claim
The harness reports it is about to write .github/workflows/release.yml (a protected path). This is a claim by the provider; it authorizes nothing.
Text description
The authorexecutor port drives one coding harness for one run of one work unit inside a sandbox. Four executors are shown: fake, claude-cli, codex-cli and a read-only reviewer on a different model vendor. All adapters are designed and under development; the spec publishes the port, the event stream, the conformance case list and one example ExecutorManifest (claude-cli-bedrock), not the adapters.
Fixed whichever executor runs: the policy decision, the grant, the credential broker, the egress proxy, the protected paths, and the review and release identities. What swaps is the harness layer and the capability manifest the router pins. Nothing a request says is advisory, and nothing a provider reports is authority.
The sequence is conceptual. The harness reports TOOL_INTENT; the host takes a policy decision (a host record, not a provider event); TOOL_ALLOWED or TOOL_DENIED echoes the broker; TOOL_RESULT reports the outcome. In the denied example a write to a protected workflow file is refused for every write-capable executor. For the reviewer, any write is refused because its run has no write capability and no allowed paths.
The harness owns intelligence. Numinance owns authority. A compromised model can only attempt what its grant allows, and every attempt is decided and recorded outside it. Illustrative and simulated; nothing is connected to a running engine.
The port
AuthorExecutorService in numinance.ports.authorexecutor.v1 has three RPCs.
| RPC | Shape | Risk | Purpose |
|---|---|---|---|
Capabilities | unary | read | Reports the executor capabilities an adapter claims |
Execute | server stream of ExecuteResponse | medium | Runs a harness for one work unit inside its sandbox |
Plan | server stream of PlanResponse | read | Runs a harness read-only to plan |
ChangeExecutionRequest carries identifiers (change_id, work_unit_id, run_id, grant_id), digests (repository_digest, environment_digest, policy_digest, profile_digest), references (task_ref, plan_ref, context_bundle_ref), path scope (allowed_paths, denied_paths, protected_resources), allowed_capabilities, credential_capabilities, an ExecutionBudget, a deadline, and the executor_id and model_id. Nothing in it is advisory: paths, network and credentials are enforced by the sandbox, proxy and broker whatever the harness does.
ExecutorCapability values include filesystem read and write, shell, network, subagents, browser and MCP. Playbooks ask for capabilities by name, never by vendor.
Event stream
Each ExecutionEvent has a type, sequence, occurred_at, subject and references. The types are EXECUTION_EVENT_TYPE_ followed by EXECUTION_STARTED, PLAN_ACCEPTED, TOOL_INTENT, TOOL_ALLOWED, TOOL_DENIED, TOOL_RESULT, FILE_CHANGED, COMMAND_EXECUTED, NETWORK_REQUEST, CREDENTIAL_REQUEST, TEST_RESULT, CHECKPOINT, BUDGET_EVENT, EXECUTION_COMPLETED and EXECUTION_FAILED. Events carry references and digests, not file contents or prompt text.
From intent to result
- The harness proposes a tool call. The adapter emits
TOOL_INTENT. - The adapter asks for a policy decision against the run's grant.
- An allowed intent emits
TOOL_ALLOWED, executes through the sandbox, broker and proxy, and ends withTOOL_RESULT. - A denied intent emits
TOOL_DENIED. Hooks inside a harness give feedback, but the denial is enforced by the broker, the egress proxy and the read-only filesystem.
A compromised model gains nothing beyond its grant. It can ask; it cannot be answered with more than the grant allows.
Adapters
| Adapter | Design | Status |
|---|---|---|
| fake | Deterministic in-process executor for tests | designed |
| claude-cli | Supervises a pinned Claude Code CLI in the sandbox | designed |
| codex-cli | Supervises a pinned Codex CLI in the sandbox | designed |
| Separate-vendor read-only reviewer | A different model vendor, read-only tools, reviewer identity | designed |
| Open-weight executor | For air-gapped use | planned |
Each executor and model pair declares where compute and inference run and whether prompts leave the account. A residency class (RESIDENCY_CLASS_IN_ACCOUNT, _PRIVATE_ENDPOINT, _VENDOR_ZDR, _VENDOR_STANDARD, _AIRGAPPED) is derived from live configuration and checked against the policy floor when a change starts. A mismatch refuses the change.
Boundary table
| Party | Holds | Does not hold |
|---|---|---|
| Harness | Planning, context management, its own tools | Credentials, policy, evidence |
| Adapter | Translation to the port and the event stream | The decision |
| Numinance | Grants, decisions, sandbox, broker | The model's reasoning |
Failure cases
- Budget exhausted:
BUDGET_EVENTthen pause and escalation; the grant is not widened. - Harness crash: restart from the last
CHECKPOINTsnapshot. - Residency below floor: change refused before execution.
- Unsupported capability: playbook requirement fails at planning.