Abstract:
As agent harnesses shifted from informal scripts to production-grade runtime systems, academic and industrial researchers formalized their core architecture. In 2026, research by Zhong & Zhu (arXiv:2605.13357) and Meng et al. established the formal mathematical model $H = (E, T, C, S, L, V)$ and the ETCLOVG Seven-Layer Taxonomy (Execution, Tooling, Context, Lifecycle, Observability, Verification, Governance). This article details each layer of the canonical architecture, analyzes the 11 component responsibilities, maps specific failure modes prevented by each layer, dissects the source-code anatomy of production harnesses (Claude Code, OpenAI Codex App Server, OpenHands), and articulates the H0–H3 maturity ladder.
In modern agent systems engineering, a harness $H$ is formalized as an integrated tuple of seven distinct subsystems:
$$H = (E, T, C, L, O, V, G)$$
THE ETCLOVG SEVEN-LAYER TAXONOMY
┌─────────────────────────────────────────────────────────────────────────┐
│ G: GOVERNANCE │
│ (Budgets, Approval Policies, Enterprise Compliance, HITL Gates) │
├─────────────────────────────────────────────────────────────────────────┤
│ O: OBSERVABILITY & ATTRIBUTION │
│ (Full OpenTelemetry Traces, Failure Attribution, Episode Logs) │
├─────────────────────────────────────────────────────────────────────────┤
│ V: VERIFICATION │
│ (Sub-5s Test Sensors, AST Linters, Compilers, Invariant Checkers) │
├─────────────────────────────────────────────────────────────────────────┤
│ L: LIFECYCLE & LOOP │
│ (State Machines, Retries, Multi-Agent DAGs, Rollback Handlers) │
├─────────────────────────────────────────────────────────────────────────┤
│ C: CONTEXT & MEMORY │
│ (Window Management, ACM Compaction, Symbolic Repo-Maps, Skill Store) │
├─────────────────────────────────────────────────────────────────────────┤
│ T: TOOLING │
│ (Model Context Protocol, A2A Protocols, Schema Validators) │
├─────────────────────────────────────────────────────────────────────────┤
│ E: EXECUTION & SANDBOX │
│ (Firecracker MicroVMs, gVisor, Ephemeral Worktrees, Resource Caps) │
└─────────────────────────────────────────────────────────────────────────┘
▲
│ Interfaces with
┌───────┴───────┐
│ FROZEN MODEL │
│ (LLM Engine) │
└───────────────┘
Each layer of the ETCLOVG architecture exists to eliminate specific, catastrophic failure modes in autonomous operations:
| Layer | Component Name | What It Owns | Failure Modes Prevented |
|---|---|---|---|
| E | Execution / Sandbox | Isolated runtimes (Docker, gVisor, Firecracker microVMs), copy-on-write worktrees, CPU/memory quotas, network egress policy. | Unconstrained side effects, host filesystem destruction (rm -rf /), fork bombs, dependency pollution, privilege escalation. |
| T | Tooling | Schema definitions, Model Context Protocol (MCP) servers, Agent-to-Agent (A2A) interfaces, tool parameter validation. | Hallucinated parameters, malformed CLI calls, crashes from unexpected tool output types, unsafe command injection. |
| C | Context & Memory | Token window budgeting, Agentic Context Management (ACM), AST symbol maps, hierarchical AGENTS.md, persistent skill libraries. |
Context window overflow, "Lost-in-the-Middle" retrieval dropoff, attention dispersion ("The Dumb Zone"), stale dependencies. |
| L | Lifecycle / Loop | Finite state machines (FSM), execution hooks, retry policies, subagent spawning, task dependency DAGs, rollback logic. | Semantic drift, infinite hallucinated repair loops, unhandled tool timeouts, loss of task state during multi-hour runs. |
| O | Observability & Attribution | Distributed tracing (OpenTelemetry), token consumption telemetry, root-cause failure attribution, episode replay logs. | Un-debuggable multi-agent failures, silent errors, untraceable hallucinations, lack of operational audit trails. |
| V | Verification | Deterministic test sensors, Test Impact Analysis (TIA), custom AST linters, type checkers (tsc, mypy), ArchUnit rules. |
Silent incorrectness, syntactic hallucinations, architectural boundary erosion, regressions in existing code. |
| G | Governance & Permissions | Allow/Ask/Deny security policies, enterprise cost budgets, human-in-the-loop (HITL) review gates, entropy auditing. | Unaccountable spending, unauthorized code merges, proprietary data leakage, non-compliant third-party code adoption. |
In AI Harness Engineering: A Runtime Substrate for Foundation-Model Software Agents, Zhong & Zhu define the eleven non-negotiable operational responsibilities of a production harness:
Analyzing production harnesses reveals how world-class systems implement the ETCLOVG layers:
┌─────────────────────────────────────────────────────────────────────────────┐
│ PRODUCTION HARNESS IMPLEMENTATION MATRIX │
├─────────────────────┬──────────────────────┬────────────────────────────────┤
│ Production System │ Architectural Pattern│ Key Technical Mechanism │
├─────────────────────┼──────────────────────┼────────────────────────────────┤
│ Claude Code │ CLI-Native Agent │ Structured streaming parser, │
│ (Anthropic) │ Harness │ terminal pager override, │
│ │ │ strict local permission gates. │
├─────────────────────┼──────────────────────┼────────────────────────────────┤
│ OpenAI Codex │ Client-Server │ Decouples reasoning loop from │
│ App Server │ Remote Harness │ container execution; runs AST │
│ │ │ linters in remote microVMs. │
├─────────────────────┼──────────────────────┼────────────────────────────────┤
│ OpenHands │ Sandboxed Generalist │ Event-stream architecture with │
│ (All-Hands AI) │ Agent Runtime │ Docker runtime, observation- │
│ │ │ action state machines. │
├─────────────────────┼──────────────────────┼────────────────────────────────┤
│ LangGraph / │ Graph-State │ Cyclic graph computation, state│
│ Deep Agents │ Orchestrator │ persistence checkpoints, │
│ │ │ human-in-the-loop breakpoints. │
└─────────────────────┴──────────────────────┴────────────────────────────────┘
allow / ask / deny permission interceptor: read operations are auto-approved, shell executions require explicit user acknowledgement unless flagged as trusted.Organizations can assess their harness readiness across four standardized maturity levels:
┌─────────────────────────────────────────────────────────────────────────────┐
│ THE H0–H3 MATURITY SPECIFICATION │
├───────┬───────────────────┬─────────────────────────────────────────────────┤
│ Level │ Designation │ Technical Capabilities & Operational Profile │
├───────┼───────────────────┼─────────────────────────────────────────────────┤
│ **H0**│ Bare Model │ • Model used via raw web chat or API completion.│
│ │ │ • Zero execution runtime; user manually pastes. │
│ │ │ • Zero verification; 100% human-verified. │
├───────┼───────────────────┼─────────────────────────────────────────────────┤
│ **H1**│ Scripted Runner │ • Ad-hoc scripts invoking bash or Python tools. │
│ │ │ • Bare host or unhardened local container. │
│ │ │ • Open-loop execution; prone to hanging on stdin│
│ │ │ • No structured error translation back to agent.│
├───────┼───────────────────┼─────────────────────────────────────────────────┤
│ **H2**│ Cybernetic │ • Dual-control: Feed-forward Guides + Sensors. │
│ │ Governor │ • Sub-5-second Test Impact Analysis (TIA). │
│ │ │ • Structured Agent-Computer Interface (ACI). │
│ │ │ • Copy-on-Write git worktree isolation. │
│ │ │ • 60–80% autonomous task completion rate. │
├───────┼───────────────────┼─────────────────────────────────────────────────┤
│ **H3**│ Full Enterprise │ • Complete ETCLOVG implementation. │
│ │ Runtime Substrate │ • MicroVM isolation (Firecracker / gVisor). │
│ │ │ • Verifiable failure attribution & audit trails.│
│ │ │ • Multi-agent orchestration via A2A / MCP. │
│ │ │ • Structured Episode Packages for all PRs. │
│ │ │ • Automated meta-harness optimization loops. │
└───────┴───────────────────┴─────────────────────────────────────────────────┘
We haven't launched yet. But leave your email to get notified about exciting things that we will launch.