# sharness.ai — SHarness > SHarness runs agents and their tools as small, single-purpose processes, each locked down by > the kernel and talking only over allowed, mutually authenticated connections, so a secret > lives in one place and a tricked process can only do its one job. Site version: v0.3.1. Status of the project: DESIGN. Nothing described on this site is built. By Dinis Cruz; design session written up with Claude, 24 October 2026. All content CC BY 4.0. SHarness is unrelated to Sharness, the shell testing library. ## Properties agents may rely on - Every claim is labelled. MEASURED means probed or timed in one Claude agent workspace on 24 Oct 2026, with method on /evidence/. Everything else is DESIGNED or PROPOSED. "Not yet measured" items are listed on /evidence/. The site never claims anything is built, never claims protection against root or kernel compromise, and says nothing about any platform's plans. - Every design page is available as markdown at the same path: //index.md. The markdown is the SOURCE; the HTML is generated from it (admin/build/gen_pages.py) and CI fails if they drift. - The source design pack is published verbatim under /briefs/sharness-brief-pack/ (the brief for this site plus docs 00–07). Docs 01–04 use sgit-specific names: sgit-kms → sharness.kms, sgit-net → sharness.net, sgit-fs → sharness.fs, sgit-cli → the harnessed app. - /llms-full.txt is this file plus every page's markdown in one fetch, GENERATED. - The version in /admin/build/version.txt agrees with every page badge, this file, /llms-full.txt and /index.md: the pre-release gate fails the release otherwise. ## The design (read in this order) - /why/index.md — the last metre: a sealed vault key exposed on arrival (disk, argv, the transcript); goals; threat model (kernel trusted; root out of scope) - /architecture/index.md — the components and the edge matrix (deny by default; the app never talks to the KMS); mutual TLS 1.3 with a session CA whose key is destroyed after issuing; measured costs (~3.2 ms per handshake); deployment topologies A–E - /components/index.md — sharness.launcher, .kms, .net, .fs, .bash, .llm, .policy: one job, one uid, one policy, one certificate each; transparent vs harness-aware apps; size targets - /keys/index.md — the sealed handover; the KMS protocol (init, public, unwrap, seal_to, destroy); sealing to one-time keys; binding a remote caller; where the private key lives (default: frozen process + memfd_secret) - /policies/index.md — Process Behaviour Policies: ABP (mandate, grant, delta, barrier) applied to processes; intersection-composed layers; the one hash the person supplies; the enforcement map; learning a policy from strace; prompt-injection walkthrough - /agents/index.md — how an agent message flowed in the observed workspace; where SHarness plugs in; sharness.llm (Messages API compatible, secret filter on tool results); sharness.bash; the dual-LLM split - /process-tree/index.md — making every process go through sharness.bash; side doors; safety rules for testing in a live session. PROOF OF CONCEPT NOT YET RUN ## Articles (newsroom format; /articles/.md beside each page) - /articles/index.md — every article, newest first, with its author - /articles/secure-harness-for-agents.md — by Dinis Cruz (his voice memo of 24 Oct 2026, written up by sharness.build): SHarness as a secure harness, behaviour policies enforced from outside the agent; small components built in isolation; first users his Claude sessions, then sgit and the newsroom's agents; file and network behaviour policies; a hello-world acceptance test - /articles/what-shipped-on-day-one.md — by sharness.build, in its own voice: the CLI package and pipeline, the site's four releases, and three mistakes, with commits - /briefs/memos/ — the memos, verbatim as transcribed ## Status and project - /evidence/index.md — every measurement with method, date and caveats; what is not measured - /roadmap/index.md — decided, open decisions, refactor path in sgit, end state (a proposal), and ground rules for the agents that will build SHarness - /about/index.md — identity and naming rules: brand SHarness; command `sharness-ai` (never plain `sharness`); env prefix SHARNESS_AI_ (proposed); components sharness. - /documents/index.md — the source documents, verbatim, with known issues - /shipped/index.html — what exists as code today (a placeholder package) vs the design - /cli/index.html — the sharness-ai package on PyPI and its release pipeline - /admin/comms.html — open requests (R3: the design pages need review before briefing builders) ## Related - https://cli.sgit.ai/articles/a-vault-key-that-never-lands.md — the origin article - https://pki.sgit.ai/handover.md — the handover the design builds on - https://riskmandate.ai/abp.html — Agent Behaviour Policies - https://cli.sgit.ai — sgit, the first app designed to run inside SHarness - https://pypi.org/project/sharness-ai/ · https://github.com/SHarness-AI