The Production Harness

2 · Context Engineering

An agent that stays accurate and cheap at scale.

Everything in the harness lives at exactly one of four layers, and the placement rule is a single sentence: content lives at the cheapest layer that still gets it applied. Layer 0 loads on every turn and is inherited by every subagent spawned from it — a bloated always-on file isn't just wasted tokens, it's tokens multiplied across every parallel worker before any of them has done a lick of work. Layers 1 through 3 exist precisely so everything else can stay out of that always-on path: skills that load only on a trigger-phrase match, reference material opened only when a task actually needs it, and unattended-loop logic that runs on its own schedule.

The placement test makes the rule operational: for every line that lives in Layer 0, ask "Would removing this cause Claude to make mistakes?" If the honest answer is no, the line moves down a layer or gets cut outright. That discipline is what keeps a project's CLAUDE.md — the file every session and every subagent pays for — short enough to still be read as instructions instead of skimmed as noise; bloated always-on files are a documented failure mode, not a hypothetical one.

Two rules carry most of the weight in practice. First, counts are pointers, not numbers: a CLAUDE.md that hard-codes a fact destined to change is a CLAUDE.md that will eventually lie to the agent reading it — write the command that counts, not the count itself. Second, memory lives in one-fact-per-file stores: an always-loaded index holds a one-line pointer per fact, while the fact's actual content and provenance sit in their own file, opened only when needed. That split is what lets memory grow without growing the tax every single call pays.

3 · Evidence Over Assertion

The end of false "done."

The Evidence Ledger is the fixed schema every completion claim must fill in: Implemented / Compiled & ran (paste the passing line) / Scenarios tested (named, never counts) / Not tested / Domain validity / Production ready. Five words are banned unless the ledger backs them field-by-field: verified, proven, fully, complete, independent. The schema exists because dispositional instructions — "be careful," "be calibrated" — lose to a model's own optimism; a fixed shape that must be completed doesn't.

Verification is the harness's top practice for a reason: a runnable pass/fail check is the difference between a session you watch and one you walk away from. Per repo, that check is make verify — regenerate every input, run everything, compare against declared tolerances, write a timestamped report, exit nonzero on any failure. Two build rules keep it honest: delete prior outputs before each run, so a compile failure can't quietly "verify" yesterday's success; and prove the harness fails correctly before trusting its green — seed a known drift, confirm a nonzero exit with a named failure and no false positives, then restore. A verifier that can't fail is decoration.

For computational work, evidence has a floor: 3–5 hand-calculated golden fixtures per feature. At scale, a second agent derives the expected outputs from the requirements and inputs alone — never from the implementation — a blind oracle that can't inherit the implementer's own mistake. Agent-vs-agent agreement upgrades confidence in a result; it never establishes it on its own.

4 · Deterministic Enforcement

Advisory rules become guarantees.

The principle is one sentence: anything "always do X" is a hook, not a sentence. Sentences are probabilistic — a prose instruction competes with everything else in context, and the probability it fires decays as context length grows. A hook doesn't compete with anything; it runs. If Claude already does something correctly without being told, that's a signal to delete the instruction or convert it to a hook, not to leave it as one more sentence hoping to be read.

The harness's most transferable piece is a single registered SessionStart hook, session-preflight.sh, that runs five checks and is exception-based: silent when everything is clean, so a healthy session pays roughly zero tokens for the guarantee. It scans memory for poisoning (report-only), checks whether local main is behind origin or the current branch tracks a deleted remote, runs an opt-in per-repo project-health smoke test bounded to 15 seconds, injects lesson titles so "read lessons at session start" is deterministic instead of hoped-for, and flags an empty memory store on an active project. None of it depends on the model remembering to check — the check runs, every time, or it doesn't run at all.

Permissions are the second deterministic layer, enforced by the harness itself rather than by the model choosing to comply: an allow list for routine work, an ask list for destructive verbs, and a deny floor for secrets. That floor — denying reads on .env, secrets/**, ~/.ssh/**, ~/.aws/** — belongs at user scope specifically because permission rules merge across scopes and evaluate deny-first: a user-level deny blocks a project-level allow, so the floor costs nothing and no repo can override it by being configured more permissively. The complement matters too: a Read/Edit deny binds the agent layer, not arbitrary subprocesses it might spawn — the OS-level sandbox is what closes that gap, not another sentence telling the agent not to.

5 · Institutional Memory & Learning

A system that compounds — and stops repeating its mistakes.

Every lesson is a fixed record, not a vibe: ID · Date · Cost · Symptom → Cause → Rule → Recovery, with a RECURRENCE annotation if the rule gets broken again. IDs are append-only and never renumbered — external docs and scripts reference them — and task queues never live here; a lessons file is incident memory, not a to-do list. The Symptom→Cause→Rule shape forces a mechanical rule out of every incident, not a resolution to be more careful next time, and the Cost field is load-bearing: it's the line that convinces a future reader — human or agent — that the rule is actually worth obeying, not just worth reading past. This is Anthropic's own structured note-taking / agentic-memory pattern — an agent that regularly writes notes persisted outside the context window — and it isn't a nicety: Anthropic's file-based memory tool reported 84% token savings and a 39% performance improvement on long tasks when paired with context editing.

Memory that isn't structured the same way rots the same way. Each project keeps a memory/ directory: one always-loaded index (one line per fact, pointer only) plus one file per fact carrying its type and a provenance line — which session wrote it, on what evidence. Facts get updated, not duplicated; wrong memories get deleted, not left to accumulate contradictions. A periodic audit checks index-to-body sync, cross-file contradictions, and ground-truth on load-bearing facts, plus a deterministic anti-poisoning scan — regex for hijack-shaped content and credential-shaped strings — that runs report-only, so it flags a problem but never blocks a session.

6 · Unattended Autonomy

Run it overnight. Wake to a receipt you can trust.

The loop that runs while I sleep maps to a fixed six-part doctrine, not an open-ended prompt: trigger, rules-load, executor, verifier, memory write, stop check. Every nightly run is one bounded unit through that shape — never an unscoped "keep going." The step that carries the most weight is the fourth: a separate, fresh-context, zero-tool model grades the diff the executor produced. The maker is never the grader — the same agent that wrote the change cannot be the one that certifies it.

A run only ends two ways: green-and-verified opens a draft PR, or anything else emits a BLOCKED receipt — never a claimed DONE that didn't earn it. Four exits, checked in priority order, keep a stuck or confidently-wrong loop from running past its evidence: the success condition itself, a retry ceiling, a verifier-disagreement ceiling, and a budget ceiling per cycle. Autonomy is earned per category on a trust ledger — runs and passes tracked, demotion on a pass-rate drop pages the human — but the ledger tops out below merge rights: promotion to auto-merge never happens, by design. The merge decision stays human, every time.

I run this every night. The full operations story — live receipts, named kill switches, the trust ledger in action — is its own case study: Operating an Agentic OS →. Here I focus on the engineering doctrine that makes it safe.

7 · Multi-Agent & Safety Discipline

Parallelism and untrusted input — without the foot-guns.

A second agent that grades a diff earns its keep only if it never sees the builder's reasoning: fresh-context verification hands a reviewer the artifacts alone — the diff, the test output, the logs — nothing else. Graders run at low effort on purpose; judging evidence is cheaper than producing it. The prompt shape matters as much as the setup: ask for all findings plus severity, and filter downstream yourself. Told to "only report high-severity," a model obeys that literally and quietly suppresses real findings underneath the bar. None of this is free — multi-agent review is less effective on tightly interdependent code, and costs roughly 15x the tokens of a single-agent pass. Reach for a second agent when an independent check is worth that multiplier, not as a default.

The same discipline that keeps a builder from grading its own work keeps an agent that reads the open internet from also holding the keys. An agent that ingests untrusted external content — scraped pages, emails, vendored bundles — runs read-only, full stop. The agent holding write or deploy power never parses that raw content directly; only sanitized data is allowed to cross the line between them.

Parallelism has its own physics once agents share a filesystem. Branch pointers, HEAD, and the stash list are shared mutable state across every worktree touching a repo: git stash is banned outright — a patch-file round-trip replaces it — and commit --amend never runs in a shared checkout. Parallel implementer agents get their own worktrees or run serially; there's no middle ground, and every parallel dispatch ends with a check that HEAD is still yours. Once a PR merges, its branch is frozen — a follow-up starts fresh off origin/main, because a squash-merge silently orphans anything still stacked on the old branch.

The same verify-before-you-act instinct applies to tools, not just agents: probe with a CLI or API before reaching for a dashboard. The ladder below runs CLI/API first, a headless script second, and a browser last — the browser is a fallback, capped at 2–3 attempts, because a model describing another product's UI from memory is guessing, not verifying.

The reader/actor boundary below is the same one that guards untrusted input in the nightly loop — see Operating an Agentic OS → for it running in production.

8 · Governance & Honest Trade-offs

Staff-level judgment: knowing exactly what to change at scale.

This pillar governs the harness itself, not the work it does. The rule is propose-only self-governance: the model drafts diffs to governing files — CLAUDE.md, permissions, hook configs — and a human approves before they take effect. That closes the one failure mode the other seven pillars can't: a model that could edit its own constraints without approval could edit away the limits meant to catch its own mistakes. One human stands in as the entire review board, and the board never rubber-stamps itself.

That only works because it's honest about its own scope. There is no universally right harness — only the harness matched to who's holding the leash. Solo, every default below buys velocity because the blast radius is one person's judgment and one person's repos: a broad allow list, one human as the whole review board, curl left open for CLI-first diagnostics. A team inherits the identical defaults and inherits the identical blast radius, except now it compounds across every engineer before anyone reviews it. None of these six calls are wrong for a solo harness; none of them survive contact with a second engineer unexamined (HANDBOOK 2.1; Part 5).

9 · Adoption Path

Transferable and teachable — the mentor's signal.

None of the seven pillars above are exotic, and none require inheriting this harness's specific archaeology. What matters is the order: each step's value has to be provable before the next step's complexity gets added, or the later steps get built on a foundation nobody has actually confirmed holds.

Day 1 (~2 hours). Write a ≤200-line ~/CLAUDE.md — hard limits, the Evidence Ledger, a pointer to the lessons file. Add the settings deny floor (secrets, SSH, cloud credentials) at user scope and smoke-test it in a fresh session. Create an empty ~/tasks/lessons.md with the entry format written at the top, before there's anything to log.

Week 1. Install the SessionStart preflight hook, starting with git pre-flight plus the lessons digest. Per active repo: a lean .claude/CLAUDE.md — paths, commands, gotchas, counts written as pointers, not numbers — and a docs/AGENT_LESSONS.md. Build make verify and prove it fails correctly before trusting its green.

Month 1. Convert your three most-repeated workflows into skills with trigger-phrase descriptions. Stand up one nightly loop through the full ramp — manual run, then skill, then receipts, then a hard binary gate, and only then a schedule. Put the memory audit and a periodic fresh-context harness re-audit on that same schedule.

10 · Grounded in Primary Sources

Rigor, not invention.

The operating reference keeps a §7 rejected-practices section for exactly one reason: best-practice advice churns constantly, and re-litigating settled questions every time a new article appears is its own kind of drift. Every new candidate practice gets triaged against the doc instead — DUPLICATE (already covered), REJECTED (considered and declined, with the reason recorded), CONFLICT (contradicts a standing rule — flagged for a decision, not silently adopted), or NEW (actually adds something). That triage is what keeps the harness from re-arguing itself on a schedule set by other people's blog posts.

The same discipline applies to this paper: every externally-grounded practice above is traced to a primary source rather than asserted from memory or convention. Two are not, and are labeled as such rather than dressed up as cited — propose-only governance and the blind-oracle check are local safety invariants this harness adopted because the failure mode warranted it, with no Anthropic doc behind them. The map below is that trace, row by row.

About the author

David Reed, PhD, is an AI/ML engineering leader with 35+ years building production systems — the last two decades in AI/ML — now focused on agentic AI in regulated domains: healthcare, edtech, and fintech-adjacent. His two patents sit on exactly the concerns this paper is about: US 6,839,229, "Large-Grained Database Concurrency Management," on safely sharing mutable state across processes — the same problem that returns when parallel agents share a git worktree — and US 6,850,988, "Dynamic E-Commerce Click Stream Analysis" (foundational to Amazon's recommendation engine), on turning behavior into evidence. Prior roles include Master Technologist at Hewlett-Packard and Principal TPM-AI at Microsoft. His public work — PACCA, a healthcare prior-authorization multi-agent platform, alongside the education-focused ALCA and LPA — lives at github.com/drdgreed, with more at drdavidreed.com.

This paper is itself the evidence: it documents AI-platform engineering (the four-layer context system, the memory architecture), staff/lead-level judgment (the honest trade-off tables, the propose-only governance model), and agentic QA discipline (the Evidence Ledger, fresh-context verification, the blind-oracle pattern) — applied to the author's own production harness, not a hypothetical one.

Appendix A — File-by-file inventory

Every file in the harness, what layer it lives at, and why.

The full inventory behind Pillar 2's four-layer model, reproduced from HANDBOOK Part 2 — one row per file, faithful to the source's own description of what each does and why it sits where it sits.

Appendix B — Source index & known gaps

Where every claim traces to, and what's still open.

Every practice in this paper resolves to one of the primary sources below, verified live against the docs on 2026-07-16. The known-gaps list that follows is deliberately unresolved — an honest harness names what it hasn't finished, not just what it has.

Known gaps

• No deterministic Stop-hook verification gate for unattended runs yet — /goal conditions are evaluator-based (probabilistic), while the docs note Stop hooks give the hard guarantee.
• The blind-oracle layer (golden fixtures + a requirements-only oracle) is policy, but not yet practiced in the newest repo's verify harness.
• ~/CLAUDE.md persona/principles section is a placement-test prune candidate — pending owner call, not yet cut.
• Prompt-caching guidance in the operating reference is the one section not re-verified against current docs this round (research fetches hit server errors) — needs a follow-up pass.

Closed for the record: deny-rule runtime verification (flagged as a gap through 2026-07-17) was smoke-tested via fresh headless sessions and closed — ~/.ssh/known_hosts and repo-local .env reads both denied, a control read of a benign file succeeded. Honesty cuts both ways: gaps get listed until closed, and closed gaps get marked closed, not quietly dropped.