jason.woltje
13968e9a8b
Addresses CPS-PRD-REV1-REVIEW-Q90 findings F1 and F3 on PR #1491: F1 (format gate): `prettier --write` on the 18 rev1 bundle documents. Whitespace, table padding, list markers and emphasis delimiters only — a normalized token comparison of every file before/after shows zero content difference, so the ratified text is unchanged and no re-ratification applies. F3 (rev0 relative links): the archived rev0 PRD stays byte-identical (sha256 60cc2f98...36afdf verified) per GOV.1 archive-never-edit. A sibling docs/PRDs/2026-08-26_PRD_rev0/README.md records the digest, the original location, the owner disposition that the in-file links are intentionally historical, and a resolution table for all 9 targets (11 occurrences), each verified to exist. Future relocated archives ship the same README instead of edited bytes. F2 (test step) is investigated separately against the CI log.
4.2 KiB
id, status, ratified
| id | status | ratified |
|---|---|---|
| HARN.1 | ratified | 2026-09-01 (Jason Woltje; PRD rev1 ratification PR) |
HARN.1 — Harness configuration
A harness is an installed agent runtime (claude, pi, codex, opencode, …). Shared contracts speak capability language; harness commands, model IDs, hooks, and settings live in runtime adapters (register OD-38).
Harness configuration surface (WebUI page + CLI)
| Control | Notes |
|---|---|
| install harness | single button push; installer runs server-side through official tooling |
| enable / disable | disabled harnesses are not selectable on any seat page |
| available models | an allowlist a seat may select from — not a selection. Whether enabledModels is role policy or harness/seat preference is open: GOV.5-open-questions Q-H1 |
| reasoning level defaults | |
| provider | which provider(s) back this harness (PROV.1-providers) |
| linked auth accounts | which accounts may drive this harness (AUTHN.1-auth-accounts) |
Enable/disable and install are runtime state (Postgres-owned) projected into whatever flat state the launcher needs (DATA.1-record-authority).
Runtime adapter contract (pulled 2026-08-31 from adapter-contract draft)
Every harness adapter binds a required capability set or fails closed:
repository ops via wrapper capability, scoped file/command execution,
structured reasoning, shared-memory capture/search/recall, inter-seat
messaging/wake, checkpoint persistence + mechanical telemetry, a mosaic coord
client that cannot mutate Kanban state or deploy seats directly, and credential
resolution through the seat's own slot. Rules:
- An unavailable capability is a named blocker, never silent degradation. "Prompt adherence is not an enforcement mechanism" — a harness that cannot persist checkpoints, emit telemetry, or honor fencing does not run workflows that need them.
- Each adapter publishes a capability→binding table (capability, binding surface, config source, verification check) and proves its bindings at session start; verification failure is a named blocker.
- Adapters bind capabilities but never redefine role authority, delivery policy, gate outcomes, or review independence — a harness whose native workflow conflicts with shared policy keeps the shared policy and records the conflict as an adapter limitation.
E2 inputs (triage 2026-08-31; see GOV.2-docs-inventory)
Canonical ground truth: the fleet/ book — concepts/desired-vs-observed-state.md
(roster-v2 sole writable authority), concepts/generated-env-launch-chain.md +
reference/generated-env-boundary.md, reference/roster-v2-fields.md,
operations/reconcile-and-recover.md (lock/generation semantics),
NORTH_STAR.md/FLEET-DOCTRINE.md (delivery-fleet north star, subordinate to
this PRD per rev0 §10).
Pending pulls: brain docs/guides/proposed/runtime/adapter-contract.md
(the register-OD-38 runtime-adapter capability contract this section cites).
enabledModels ruling (Q-D4, Jason 2026-09-01)
The Role Revision defines the allowed model set — a policy ceiling. The seat records model preferences within that set. Effective models = the intersection, consistent with the L2-D39 authority-intersection chain. A seat preference outside the role ceiling is refused, not silently clamped.