Components

Where the components sit and which may talk to which is on Architecture.

The harnessed app (for sgit: its CLI)

An agent loop such as Claude Code is the same role for agents: it routes, and runs nothing itself (see Agents and LLMs).

sharness.launcher

Runs outside every domain. In order:

1. Read the policy manifest, compute its hash, and refuse to continue unless it matches the hash the person supplied or the manifest carries a valid signature from the root key.
2. Create one ephemeral uid per component (measured: user + firewall rule + locked launch + teardown ≈ 49 ms).
3. Create the session CA and the role certificates; destroy the CA key; record the CA certificate hash.
4. Start sharness.kms; it makes the session identity and prints only the public bundle (k1); freeze it.
5. Per command, start the other components under their policies (new namespaces ≈ 4 ms, measured), let them run, tear them down.
6. At session end, thaw and kill sharness.kms; delete users, firewall rules and sockets.

Who runs the launcher decides what the locks are. If the agent runs it inside its own session, the locks are a Boundary for everything the agent starts but only a Setting for the agent itself (in the measured environment the agent is root and could undo them). A script that starts the agent makes them a Boundary for the agent; the platform running the launcher makes them a Boundary all the way down.

sharness.kms

It never returns a clear key. Protocol and key lifetime: Keys and the KMS.

sharness.net

sharness.fs

sharness.bash

Bash is the escape hatch from every other component: while the model can run any command as root with network, the policies on .fs, .net and .kms mean little. A command is free text, so no schema can bound its intent; enforcement is on what the process can do.

Profiles are chosen by policy and requested by the model: analyse (workspace read-only, no network), build (read-write, package registries and GitHub via .net), admin (fresh approval from the person each time). Making Bash impossible to skip is Enforcing the process tree.

sharness.llm

A Messages API endpoint with a Process Behaviour Policy, sitting where ANTHROPIC_BASE_URL points. It checks the request (model allowlist, pinned tools list, token budget), filters every tool result and user message for secrets, adds the real API key (obtained sealed from .kms), forwards, and streams the response back unchanged. Details on Agents and LLMs.

sharness.policy

Not a process: the manifest, one entry per component, composed by intersection and hashed. The hash the person supplies covers everything, including the session CA certificate and the code hash of every component. See Process Behaviour Policies.

{
  "pbp_manifest": 1,
  "harness": "sharness/0.1",
  "session_ca_cert_sha256": "…",
  "components": {
    "kms":  {"policy": "sha256:…", "code": "sha256:…"},
    "net":  {"policy": "sha256:…", "code": "sha256:…"},
    "fs":   {"policy": "sha256:…", "code": "sha256:…"},
    "bash": {"policy": "sha256:…", "code": "sha256:…", "profiles": ["analyse", "build", "admin"]},
    "llm":  {"policy": "sha256:…", "code": "sha256:…", "tools_sha256": "…"}
  },
  "apps": {
    "sgit":        {"policy": "sha256:…", "mode": "harness-aware"},
    "claude-code": {"policy": "sha256:…", "mode": "transparent", "exec_allow": ["node", "rg", "sharness-bash-client"]}
  },
  "edges": [["app","fs"],["app","net"],["app","bash"],["app","llm"],["net","kms"],["llm","kms"],["bash","net"]]
}

Two ways for an app to be compatible

Running an unmodified app in the harness breaks it: it tries to write where it may not, connect where it may not, read keys that are not there.

Transparent (no app changes). The harness presents ordinary interfaces backed by its components:

Harness-aware (small app changes) for what transparency can't do, mostly secrets. For sgit: one key-source interface backed by sharness.kms; clone --sealed, vault_key.sealed, vault seal --to, plain keys refused on argv; later, vault crypto and server I/O move into sharness.net.

The rule: an app needs harness awareness only where it handles secrets or where a policy must understand its protocol. Everything else is transparent.

As little code as possible

Most of the harness is configuration of things Linux and Python already have:

Size targets (proposed): launcher ≤ 400 lines; each component ≤ 300; a shared library (Landlock, mutual TLS, framing, schema check) ≤ 400. Components must be small enough to read in one sitting; that is part of their security.

Sources: 05-sharness §1, §3–5; 01-architecture §2, §6; 06-llm-and-the-agent-loop §3–4.