SHarness — agents and tools as small, locked-down processes

It started with one gap

A vault key handed to an AI agent was sealed while it travelled and exposed the moment it arrived: on disk, on the command line and in the agent's transcript.

   travel                          arrival (sgit 0.24.0 today)
 ┌────────────────────┐   ┌──────────────────────────────────────────────────────┐
 │ QR: sealed to the  │──►│ pki-agent open --save  → vault-key-<id>.txt   CLEAR │
 │ receiving agent    │   │ sgit clone <vault key> → argv, shell history, CLEAR │
 │ (person can't read)│   │                          the agent's transcript     │
 └────────────────────┘   │ .sg_vault/local/vault_key            (0600)  CLEAR │
                          │ .sg_vault/local/key-rnd-imm-*.pem    (PKCS#8) CLEAR │
                          │ .sg_vault/local/token                         CLEAR │
                          └──────────────────────────────────────────────────────┘

For an agent the worst leak is the transcript: every command line it writes and everything a command prints lands in the model's context and in conversation logs. The last metre, in full →

The fix turned out to be general

A launcher starts a few components, each under its own Process Behaviour Policy, enforced by Linux (separate users, Landlock, seccomp, namespaces, cgroups) and by mutual TLS between components. The person supplies the hash of the policy, so a prompt-injected agent cannot widen it.

                 person: supplies the policy hash, carries sealed QR codes
                                        │
 ┌──────────────────────── sharness.launcher (outside every domain) ─────────────────────────┐
 │  harnessed app / orchestrator  (no keys, no tools of its own)                              │
 │       │               │                │                 │                                 │
 │       ▼               ▼                ▼                 ▼                                 │
 │  sharness.fs     sharness.net     sharness.bash     sharness.llm ──────► model API         │
 │  (writes)        (network) ──┐    (sandboxes)            │                                 │
 │                              └──────► sharness.kms ◄─────┘   (keys and sealed secrets)     │
 │  every edge: mutual TLS, roles in certificates · every component: own uid, own policy      │
 └────────────────────────────────────────────────────────────────────────────────────────────┘

Designed, not built. sgit (sgit.ai's encrypted vault CLI) is the first app designed to run inside it.

sharness.kms

Holds the keys

Opens sealed things and re-seals what the caller needs to a one-time key. Never returns a clear key. Frozen between calls.

Read → sharness.net

The only network client

Host, endpoint and id allowlists, enforced as the TLS client, where the name can actually be seen and verified.

Read → sharness.fs

The only writer

Writes protected folders under rules, and refuses anything that parses as a clear key, a private key or a token.

Read → sharness.bash

The shell, sandboxed

Each command in a fresh sandbox: own uid, no network by default, a workspace with no execute right.

Read → sharness.llm

The only model client

Speaks the Messages API unchanged, filters secrets out of every tool result, and holds the real API key via the KMS.

Read → sharness.policy

One hash, from the person

Intersection-composed policies, hashed. The launcher refuses any manifest whose hash the person did not supply.

Read →

Articles

Dinis Cruz's memos written up in his voice, and the build agent's record of what it delivered. In the newsroom's format, so each can be imported there unchanged.

Dinis Cruz · 24 Oct 2026

What this site claims, and how

The same distinction runs through every page. Every number is labelled; nothing is presented as built.

Label	Means
Measured	Probed or timed in one Claude agent workspace, as of 24 Oct 2026, with the method on Evidence. For example: a mutual TLS handshake between components ≈ 3.2 ms; a `memfd_secret` page unreadable even by root.
Designed / proposed	How SHarness would work: the components, the KMS protocol, the policies, `.llm`, `.bash`, the deployment topologies.
Not yet measured	seccomp filters, read-only bind mounts, the side doors in the process tree, AWS KMS compatibility.
Never claimed	That anything is built or released; protection against root or kernel compromise; anything about any platform's plans; that a schema bounds intent (it bounds shape).

The roadmap and open decisions → · the source documents, verbatim → · about and naming →

A secret lives in one place.
A tricked process can only do its one job.