The agent harness
Bigwave is built for harness engineering — the discipline (as the term has crystallised in 2026) of building software infrastructure that turns an LLM that can call tools into an agent that can ship work without constant human supervision.
What harness engineering is
A useful 2026 definition (paraphrased from the agent-tooling community — NxCode, LangChain, related):
Harness engineering is the discipline of designing, building, and maintaining the software infrastructure that makes autonomous AI coding agents reliable, accountable, and productive. It goes beyond prompt engineering by creating safe, constrained environments (sandboxes) for agents to operate, featuring automated validation loops, tool orchestration, and error recovery.
The category emerged because prompt engineering alone wasn't enough: getting an agent to ship a real PR or close a real ticket without supervision needs deterministic rails around the non-deterministic core. The rails are what we mean by the harness.
What the harness is not
- Not just prompt engineering. The system prompt is one input; the harness is the runtime that runs around the agent.
- Not "yet another orchestration framework." Frameworks like LangChain compose chains in a notebook; harnesses run agents in production.
- Not the model itself. The harness is what the model is bound by — gates, sandboxes, audit, rollback.
The eight primitives
The properties that distinguish a real harness from agent-adjacent glue:
1. Tool orchestration
Define the tools an agent can use, scope permissions per workspace, govern how the agent invokes them. Bigwave today: OpenAI-shape tool-calling in /v1/chat/completions, MCP client on the roadmap. Workspace-scoped permission registry on the roadmap catalogue.
2. Deterministic guardrails
Rules that prevent harmful actions before the model can take them. Pattern-matching, deny-lists, regex, allow-lists. Cheap, fast, predictable. Bigwave: DSLGuardrailProvider (shipped) wired into chat dispatch; Block decisions short-circuit with OpenAI- shape finish_reason="content_filter". Llama Guard adapter on the roadmap catalogue.
3. Validation loops
Automatic verification that the agent did what it was supposed to. Bigwave: eval-as-a-gate (shipped, see eval-as-gate concept) wired into adapter activation; trajectory- match, hallucination probe, jailbreak probe scorers on the roadmap catalogue (per the agent-eval use case).
The validation loop is the differentiator between "agent that might work" and "agent that ships." Without it, every regression is a customer-facing incident.
4. Error recovery
What happens when the agent's first try doesn't work. Bigwave: fallback chain (chat_with_fallback), automatic retry across model handles, rollback to previous adapter on gate refusal (drain-and-swap with rollback semantics). Self-healing through the closed feedback path: agent regression → user feedback → preference data → DPO → corrected model.
5. Sandboxing
Isolated execution environments where the agent can run code, inspect files, hit network endpoints — without affecting the host. Sandboxing is the property that turns "agent in chat" into "agent that builds, tests, and ships."
Bigwave: not shipped. This is the load-bearing gap between "agent-adjacent" and "the agent harness." Closing it is the highest-leverage product priority — sandbox runtime + long-running agent state.
6. Accountability
Every action by every agent attributable, replayable, signed off. Bigwave: workspace-scoped append-only AuditLogRepository, every mutation recorded with actor + entity + before/after. Available at /admin/audit. Built for GRC.
7. Tenant isolation
Agent A cannot read or write into agent B's workspace. Cross- tenant fetches return 404 (never 403, never a count-oracle leak). Bigwave: workspace fence enforced at the repository layer (see workspace-fence concept); every persistent surface participates.
8. Binding promotion gate
A regressed agent cannot ship. The eval gate is wired into ReplicaManager.activate; on GateBlock, the activate route returns 422 and the old handle is preserved. No "ran the eval and shipped anyway." See eval-as-a-gate concept.
How Bigwave maps to harness engineering
| Harness need | Bigwave today | Roadmap |
|---|---|---|
| Tool orchestration | gateway dispatch + tool-calling | MCP client |
| Deterministic guardrails | DSL provider + chat-input check | Llama Guard, streaming output check, corpora |
| Validation loops | eval-as-a-gate, scorer ABCs | trajectory-match, hallucination, jailbreak scorers (agent-eval wedge) |
| Error recovery | fallback chain, drain-and-swap rollback, feedback path | circuit breakers |
| Sandboxing | not shipped — load-bearing gap | sandbox runtime + long-running agent state |
| Accountability | audit log + workspace fence + provenance | retention + streaming exports, audit packet |
| Tenant isolation | workspace fence at every repository | RBAC |
| Binding promotion gate | EvalGate → 422 → rollback | streaming output gate, trajectory gate (per agent-eval wedge) |
Six of the eight primitives are production-ready. Two (sandboxing
- long-running agent state) are the highest-leverage gaps.
What this changes about who Bigwave is for
The agent-harness thesis sharpens the buyer:
- Strong fit: teams running autonomous AI coding agents (the Cursor / Continue / Claude Code / Devin / Aider audience), agent-startup ML teams shipping production agents, regulated industries running AI agents that need audit-defensible accountability.
- Adjacent fit: general LLMOps users who want a coherent stack but aren't running autonomous agents — Bigwave still works, but the harness-engineering pitch lands less hard.
The four wedges in docs/wedges/ reflect this; coding-agent backend and agent-eval are the lead wedges, compliance and support-tone are adjacent LLMOps applications of the same substrate.
Reading order
- The loop — the closed feedback path, one capability of the harness.
- Eval-as-a-gate — the binding-promotion property in detail.
- Workspace fence — tenant isolation in detail.
- Optional-by-design adapters — the substrate.
- Coding-agent harness use case — the canonical harness-engineering ICP.
- Agent eval use case — the binding-gate capability sold standalone.