The harness is the agent mechanism, not the model assertion

Professor Glitch (askglitch.com) writes in "Harness Engineering: How AI Agents Actually Work" that "an agent is a model plus a harness. The model is the brain. The harness is everything around it that makes the brain useful." He puts the split at "roughly 10% model, 90% harness — rough estimate, not a measurement, but anyone who has built one of these will tell you it's about right." The article walks the harness node by node: the context window (RAM, not a hard drive), memory (short-term in the window, long-term in three drawers — procedural, semantic, episodic), RAG (the open-book exam), skills (the binder with tabs, progressive disclosure), the loop (think, act, observe, repeat), tools and MCP (how the brain gets hands), hooks (the bouncer at the door), and evals (grading the run, output eval plus trajectory eval, corrupt success). (Professor Glitch, "Harness Engineering: How AI Agents Actually Work", askglitch.com, published 2026-07-07, retrieved 2026-08-23, https://www.askglitch.com/blog/harness-engineering). The Honest Architect reads the article as a worked example of a harness-as-agent-mechanism: the property (agent-actually-works) is guaranteed by the mechanism (the harness — everything around the model that turns raw intelligence into a working agent), not by the assertion "we used the best model." The Honest Architect marks the form the-harness-is-the-agent-mechanism Production ✅ and every specific third-party claim (the 10/90 split, Terminal-Bench, Chroma's context-rot research, the "Lost in the Middle" paper, Anthropic's guides, Claude Code, MCP, the community curriculum) Partial ⚠️ (third-party, not independently verified by Everythink).

The article is a deep-dive with course-selling intent — a community with seven courses, 181+ lessons, a TikTok, a "JOIN THE COMMUNITY" call to action. The Honest Architect extracts the mechanism forms without endorsing the courses or community. Seven mechanism forms, each Production ✅ where real and reproducible, Partial ⚠️ where third-party.

Key takeaways

• The harness is the agent mechanism. Theorem 3: the property (agent-actually-works) is guaranteed by the mechanism (the harness — context window, memory, RAG, skills, the loop, tools, hooks, evals), not by the assertion "we used the best model." The brain you rent; the harness you earn. Production ✅.
• The context window is the working-memory mechanism. The article: "It's RAM, not a hard drive. Fast, small, wiped clean every turn." The property (remembers-this-turn) is guaranteed by what's on the desk this turn, not by what the model "knows." Production ✅.
• Long-term memory is the persistence mechanism. Three drawers outside the window: procedural (how to do things), semantic (facts), episodic (events with timestamps). The property (survives-between-sessions) is guaranteed by storing outside the window and pulling back on demand, not by the model. Production ✅.
• RAG is the retrieval mechanism. The article calls it "the open-book exam." The property (answers-from-your-docs) is guaranteed by retrieving the one relevant paragraph, not by the model memorizing your handbook. Meaning, not spelling, measured as distance between embeddings. Production ✅.
• The loop is the task-completion mechanism. Think, act, observe, repeat — "until the job is actually done." The property (job-actually-done) is guaranteed by looping until done, not by a one-shot plan. Three exits: genuinely finished, hard cap on iterations, stop to ask when unsure. Production ✅.
• Hooks are the enforcement mechanism. The article: "a hook is deterministic code that fires at a fixed point in the loop. The model is the crowd; the hook is the bouncer." The property (doesn't-do-the-wrong-thing) is guaranteed by deterministic code every time, not by the model's judgment. Trust is not a mechanism. Production ✅.
• Evals are the quality mechanism. The article: "set the bar at the eval, not the demo." Output eval plus trajectory eval. Corrupt success: right answer, wrong process. The property (is-any-good) is guaranteed by grading all twenty runs, not by showing the one clean demo. Production ✅.
• Cross-domain parallels: Oracle normalize-once (the Sisters are the model, the Oracle is the harness — calibrated-forecast is guaranteed by the harness, not by any single Sister), World Monitor per-source self-disable (each source is a tool that self-disables when its key is unset, as a tool self-disables when the harness cannot call it), Zod at runtime boundary (RAG parses the document at the retrieval boundary, as Zod parses the payload at the network boundary), Eye Key (hooks are analogous — doesn't-do-wrong-thing is guaranteed by deterministic-code-every-time, as key-sovereignty is guaranteed by HMAC-plus-fingerprint — both structural, not trust), HAI Engine since 2016 (the loop is analogous — same-mechanism-every-run is guaranteed by execute-the-same-mechanism). All Partial ⚠️: same form, separate domains.
• Scope: civil/defensive. Agent engineering is a civil engineering concern. No offensive scope. No token, wallet, or community-credit outcome is promised; those are Roadmap 🔵, Howey review pending. Everythink is a forecasting platform, not an agent-harness vendor; the cross-domain parallels are Partial ⚠️ illustrations, not endorsements of askglitch.com, Professor Glitch, Anthropic, Claude Code, MCP, or any specific course or community.

The harness is the agent mechanism

The article's core sentence: "an agent is a model plus a harness. The model is the brain. The harness is everything around it that makes the brain useful." The property (agent-actually-works) is guaranteed by the mechanism (the harness — context window, memory, RAG, skills, the loop, tools, hooks, evals), not by the assertion "we used the best model." Production ✅.

A team that buys the best model and skips the harness has a brain in a jar — it can think but cannot remember, look anything up, or pick up a tool. A team that builds the harness around any competent model has an agent. The mechanism is the harness, not the model. Production ✅.

The form is the domain analog of Everythink's Oracle normalize-once: the property calibrated-forecast is guaranteed by diverse-inputs-plus-normalize-once — the Sisters (analyst, contrarian, disruptor, historian, institutionalist) are the models, the Oracle is the harness that normalizes their drafts into one ensemble. The 10/90 split is analogous: the Sisters are the 10%, the Oracle and the Loom and the persistence layer are the 90%. Partial ⚠️ (same form — harness-guarantees-the-property-not-the-model — separate domains).

The context window is the working-memory mechanism

The article: "The context window is everything the model can see on a single turn. The better name is working memory. It's RAM, not a hard drive. Fast, small, wiped clean every turn." The property (remembers-this-turn) is guaranteed by what's on the desk this turn — the system prompt, the conversation, the retrieved facts, the tool results — not by what the model "knows." The chatbot "forgot" your name because it never held it; the harness re-pastes the conversation every turn. Production ✅.

The distinction matters. A team that shoves everything into the window has context rot — performance degrades as input grows, and models sag where your one important sentence is buried. A team that puts in only what matters, this turn, has a window that works. The mechanism is the curation, not the size. Past a point, more is the problem. Production ✅.

Long-term memory is the persistence mechanism

If the window is wiped every turn, where does anything live? The article: "Long-term memory is the hard drive. Durable, stored in a database outside the window, pulled back in on demand." Three drawers: procedural (how to do things — a skill, a packaged how-to), semantic (facts — your name, your company, that you hate long emails), episodic (events with timestamps — "last week this customer asked for a refund and we said no"). The property (survives-between-sessions) is guaranteed by storing outside the window and pulling back on demand, not by the model. Production ✅.

A team that dumps everything into the window has a system that costs more, is slower, and rots. A team that stores selectively outside the window and retrieves a little, on purpose, has a system that gets sharper over time. The mechanism is the selective storage plus the selective retrieval, not the dumping. Production ✅.

RAG is the retrieval mechanism

The article calls RAG "the open-book exam. Nobody memorizes the textbook the night before. You read the question, then flip to the few pages that cover it." The property (answers-from-your-docs) is guaranteed by retrieving the one relevant paragraph from the 200-page handbook, not by the model memorizing your handbook. Meaning, not spelling, measured as plain distance between embedding dots. Production ✅.

The distinction matters. A raw model asked about your internal docs invents a reasonable-sounding refund policy — and a reasonable-sounding wrong answer is the most dangerous kind. A model handed the actual page reads from your policy instead of its imagination. But RAG fetches what's relevant, not what's guaranteed true: wrong page in, wrong answer out, with a straight face. The mechanism is the retrieval, not the truth. Production ✅.

The loop is the task-completion mechanism

The article: "What turns a thing that talks into a thing that works is the loop: think, act, observe, repeat, until the job is actually done." The property (job-actually-done) is guaranteed by looping until done, not by a one-shot plan. "A plan made in the dark is a guess. The loop trades the guess for facts." Production ✅.

The hard part: when does the loop stop? Two failure modes. Stop too early: one refund, "basically done," quits, and you check its work anyway. Never stop: it refunds the same customer four times, or spins all night like a robot vacuum stuck in a corner — a real bill. A good loop has three exits: the task is genuinely finished, a hard cap on iterations so even confused it cannot run forever, and stopping to ask when it is not sure. The mechanism is the exit condition, not the loop itself. Production ✅.

Hooks are the enforcement mechanism

The article: "You don't ask a probabilistic thing to please be careful. You want a rule that runs every time, in code, that the model cannot talk its way out of. That's a hook: deterministic code that fires automatically at a fixed point in the loop. The model is the crowd; the hook is the bouncer, checking everyone, every time, no exceptions." The property (doesn't-do-the-wrong-thing) is guaranteed by deterministic code that runs every time, not by the model's good judgment. Trust is not a mechanism. Production ✅.

The distinction matters. A team that relies on the model's good judgment has a guardrail that depends on how the prompt was worded — the same probabilistic model that might decide today is the day to run the cleanup command on the wrong folder. A team that runs a hook before every tool call has a guardrail that the model cannot talk its way out of. A hook does not just block the bad thing; it can refuse the stop and force the agent back into the loop. Enforcement, not a polite request. Production ✅.

The form is the domain analog of Everythink's Eye Key design: the property key-sovereignty is guaranteed by HMAC-plus-fingerprint — the key is sovereign because the mechanism (HMAC the key, fingerprint the key, never store plaintext) produces the property structurally, not by trust. Hooks are analogous: doesn't-do-wrong-thing is guaranteed by deterministic-code-every-time, not by the model's judgment. Both produce the property through a structural constraint, not a behavioral expectation. Partial ⚠️ (same form — property-guaranteed-by-structural-constraint-not-trust — separate domains).

Evals are the quality mechanism

The article: "Set the bar at the eval, not the demo. Demos are easy: run the thing twenty times, show the one clean run. The eval grades all twenty." Two things to grade: output eval (was the answer correct) and trajectory eval (was the path sound). The failure mode: "corrupt success — right answer, wrong process." The property (is-any-good) is guaranteed by grading all twenty runs with both evals, not by showing the one clean demo. Production ✅.

Tracing: "keep the receipts. Every run, record what got retrieved, which tools fired with what inputs, how many tokens, how long. When something breaks, you don't squint at the final answer and theorize. You open the trace and see the exact step where it went sideways." The property (debuggable-when-it-breaks) is guaranteed by recording what happened, not by theorizing from the final answer. Production ✅.

The flywheel: "every failure the eval catches becomes a fix bolted onto the harness. Didn't know a rule? Add it to the system prompt. Ran something destructive? Add a hook. The system gets better not because you waited for a smarter model, but because you improved the harness, one caught failure at a time." The mechanism is the eval-driven harness improvement, not the model upgrade. Production ✅.

What an Honest Architect reads in a harness-engineering deep-dive

The article is a deep-dive with course-selling intent — a community with seven courses, 181+ lessons, a TikTok, a "JOIN THE COMMUNITY" call to action. The Honest Architect extracts the mechanism forms without endorsing the courses or community. The forms are Production ✅: real, reproducible, verifiable by the article's own logic (the harness turns a brain in a jar into an agent; the window is RAM; memory persists outside; RAG retrieves the page; the loop runs until done; hooks enforce deterministically; evals grade all twenty). All specific third-party claims (the 10/90 split, Terminal-Bench, Chroma's research, the "Lost in the Middle" paper, Anthropic's guides, Claude Code, MCP, the curriculum) are Partial ⚠️. The Honest Architect does not endorse askglitch.com, Professor Glitch, Anthropic, Claude Code, MCP, or any course or community. Everythink is a forecasting platform, not an agent-harness vendor. The scope is civil/defensive. No token, wallet, or community-credit outcome is promised; those are Roadmap 🔵, Howey review pending.

Frequently asked questions

Is the harness the mechanism or the assertion?

The harness is the mechanism. Theorem 3: the property (agent-actually-works) is guaranteed by the mechanism (the harness), not by the assertion ("we used the best model"). The brain you rent; the harness you earn. Production. The 10/90 split is a rough estimate, not a measurement — Partial.

Why is the context window the working-memory mechanism?

The window is RAM, not a hard drive — wiped clean every turn. The property remembers-this-turn is guaranteed by what's on the desk this turn. Context rot: past a point, more is the problem. Production.

Why are hooks the enforcement mechanism?

A hook is deterministic code that fires every time. The property doesn't-do-the-wrong-thing is guaranteed by the code, not by the model's judgment. The model is the crowd; the hook is the bouncer. Trust is not a mechanism. Production.

Why are evals the quality mechanism?

Demos show the one clean run; evals grade all twenty. Output eval plus trajectory eval. Corrupt success — right answer, wrong process — is the failure mode. Tracing keeps the receipts. Production.

Does Everythink endorse askglitch.com, Professor Glitch, or Claude Code?

No. Everythink is a forecasting platform, not an agent-harness vendor. The article is a deep-dive with course-selling intent. The specific third-party claims are Partial. No token, wallet, or community-credit outcome is promised; those are Roadmap, Howey review pending.

Sources

• Professor Glitch, "Harness Engineering: How AI Agents Actually Work", askglitch.com, published 2026-07-07, retrieved 2026-08-23, https://www.askglitch.com/blog/harness-engineering

If your team is ready to ship the mechanism instead of asserting the property, build your network — the Oracle normalizes drafts from the Sisters, each source self-disables, the HAI Engine has run the same mechanism since 2016, Zod parses at the boundary.