AI-Native Series · Control for Agentic Systems

The Body You Give It

By Paul Jialiang Wu · agentic-portfolio-lovat.vercel.app · 2026-08-24 · Episode 2 of 4

Cold open

You give up on better slips. You build the kitchen instead.

Knives within reach. A labelled pantry. A thermometer. A bin. A door that only opens outward. A notebook nailed to the bench where every dish is written down as it goes out.

You have not made the cook smarter. You have changed what the cook is able to do — and, more importantly, what the cook is able to find out. This is harness engineering, and it is where most of the real engineering currently lives — the layer the prompt literature was already reaching into before it had a name (arXiv:2401.14423), and the one Promptware Engineering (arXiv:2503.02400) pointed at when it argued for process around prompts rather than better wording.

Then you look up the definition, and the tidy diagram everyone draws falls over.

The definition that breaks the diagram

The usual picture nests four layers: a prompt inside a harness, a harness running loops, a graph coordinating loops. It is clean, it is teachable, and its own most-cited source does not agree with it.

Anthropic's Scaling Managed Agents (Anthropic, 2026a) decomposes an agent into three named parts:

"a session (the append-only log of everything that happened)" "a harness (the loop that calls Claude and routes Claude's tool calls to the relevant infrastructure)" "a sandbox (an execution environment where Claude can run code and edit files)"

[DEF] Read the middle one again. In the vendor's own definition, the harness is the loop — the thing that calls the model and routes its tool calls. Not a container the loop sits inside.

[DESIGN] So "harness engineering" and "loop engineering" are not two adjacent layers in a stack; they are two views of the same object. Harness names the components — tools, sandbox, context assembly, memory, permissions, evals. Loop names the dynamics — what repeats, what is observed, when it stops. You can build a harness with a terrible loop and a good loop on a starved harness, which is why keeping both words is useful. But drawing one strictly inside the other is a claim the sources do not support.

1:1 technical map

The claims, classed

[DESIGN] The harness is where long-running work actually breaks — on a vendor's account of its own design, which is a design report and not a measurement. Anthropic's Effective harnesses for long-running agents (Anthropic, 2026b) is organised around exactly the failures that are invisible at the prompt layer: state handoff, progress tracking, context management and compaction, initialisation, and incremental sessions. Those are not prompt problems and no rewording fixes them.

[OPEN] OpenAI's Harness engineering post and Unrolling the Codex agent loop (OpenAI, 2026) describe the same shift from the other vendor's side: the interesting engineering surface is the environment and the transformation from user input → instructions → model call → tool execution → repeat, not the instruction alone. (Both URLs return 403 to a plain script — bot-blocking, not absence. I have not read either page's text, which is why this claim is tagged open rather than evidenced.)

[DESIGN] Building Effective AI Agents (Anthropic, 2026c) draws the line the whole field keeps re-drawing: workflows are predefined orchestration paths; agents are systems where the model dynamically controls process and tool use. Hold onto that distinction — Episode 4 is entirely about what happens when you pretend one is the other.

[OPEN] Nobody has a published, comparable metric for harness quality. We can measure task success end-to-end, but attributing a gain to context assembly versus tool design versus the loop's stop rule is unresolved — and it is the same attribution problem Episode 1 left open, one layer up.

Prediction Gate

Commit before reading on.

An agent has a 200k-token context and a harness that appends every tool result verbatim. It works beautifully for 40 minutes, then starts making mistakes it was not making at minute 5 — including re-doing work it already completed.

Bet: name the mechanism. Is this the model degrading, the prompt decaying, or the harness?

If you bet "the model got worse," you have made the field's most common attribution error. The model is identical. The constraint that was stated first has been pushed out of the window by transcript, and the agent is now optimising against a truncated version of its own instructions. This is a harness failure with a prompt failure's symptoms — which is why compaction is a first-class harness concern rather than a nicety.

Failure Room

Break it deliberately: keep every tool, delete the session log.

Give the agent full tool access, a good sandbox, and a fresh context on every turn with no append-only record. Watch what happens: it repeats completed work, contradicts its own earlier decisions, and — this is the tell — it never notices, because noticing requires comparing now to before.

Diagnosis: the session log is not storage, it is the sense organ for time. Remove it and you have not slowed the agent down; you have made it unable to have a loop at all. Which is exactly the handover to Episode 3, and it is why the vendor definition puts session and harness side by side.

Lab — 15 minutes

Measure the thing nobody measures: context assembly cost.

1. Instrument one agent task. Log, per turn: tokens of instruction, tokens of retrieved context, tokens of transcript, and whether the turn succeeded.
2. Plot the three components over the run. Most systems show instruction flat, retrieval spiky, and transcript growing monotonically until it dominates.
3. Now cap the transcript at 50% of the window with naive truncation, and re-run. Note the failure mode change, not just the rate — naive truncation typically converts "slow and correct" into "fast and confidently wrong."

The number you want is the turn index at which transcript exceeds instruction. After that point, your prompt is a minority shareholder in its own context.

Reality Mission

Take an agent you actually run. Write down its harness on one page under six headings: tools, sandbox boundary, context assembly, memory/session, permissions, evals. Any heading you cannot fill in from the code — not from intent — is an unowned part of your system. In my own engine that exercise is what turned a scatter of flags into a reviewable file, and the parse gate that came with it is the subject of a separate write-up, I Scored 100% on My Own Checklist.

Research Challenge

Use an agent to build the missing harness metric. Fix the model and the loop; vary only context assembly across three strategies (full transcript, recency window, summarise-and-pin-constraints) on the same task suite. Report success rate and the turn index where transcript overtakes instruction. The claim to test: the second number predicts the first better than any prompt edit. Currently [OPEN].

Exit test

1. In Anthropic's own decomposition, what is a harness? (the loop that calls the model and routes its tool calls)
2. Why is "harness inside which the loop runs" a claim rather than a definition?
3. Name a failure that presents as a prompt problem and is actually a harness problem. (a stated constraint pushed out of context by transcript growth)

Cliffhanger

You have a body, a pantry, a thermometer and a notebook. The plates go out and come back, and now you can see them come back. So you start doing the obvious thing: read the returned plate, adjust, send another slip. Read, adjust, send. Read, adjust, send.

You have just built a feedback loop, and you are about to discover that this is the oldest and most thoroughly analysed object in the entire season — and that the one question the 19th century learned to ask about it is a question your agent stack cannot currently express.

→ Episode 3 — The Governor

Read next

• The Commission — Season 7, episode 1 — the same rung BUILT rather than argued, with a runnable notebook and two applications from scratch
• The Consequence Engine — Season 1, episode 1 — the seven-box loop behind reinforcement learning for language models

Episode 2 of Intelligence Engineering Adventures, Season 6 — The Governor Engine. Claims in the series source are tagged by class — definition, derivation, evidence, engineering choice, open question — and a metaphor may introduce a claim but never serves as evidence for it. The season takes the four-label diagram seriously enough to check it against its own primary sources, and it does not survive: Anthropic's definition makes the harness the loop rather than a layer above it. Every claim is tagged by class, and the one genuinely open problem is stated as open — nobody has published a stability criterion for an LLM control loop. This article contains no material from any employer or client. — Paul Jialiang Wu · agentic-portfolio-lovat.vercel.app

References

1. (Anthropic, 2026a) Scaling Managed Agents: Decoupling the brain from the hands (Apr 8, 2026) — the session / harness / sandbox decomposition; quoted verbatim above. https://www.anthropic.com/engineering/managed-agents
2. (Anthropic, 2026b) Effective harnesses for long-running agents — state handoff, progress tracking, context management and compaction. https://www.anthropic.com/engineering/effective-harnesses-for-long-running-agents
3. (Anthropic, 2026c) Building Effective AI Agents — workflows (predefined paths) vs agents (model-directed process and tool use). https://www.anthropic.com/engineering/building-effective-agents
4. (OpenAI, 2026) Harness engineering: leveraging Codex in an agent-first world; Unrolling the Codex agent loop. Both returned HTTP 403 to a scripted fetch on 2026-08-24 (bot protection); cited from the brief's description, not from text I retrieved.