Multi-harness agent governance — Phase 0 + 1 (dogfooded)

[apple-techie]

Summary

Phase 0 + 1 of multi-harness agent governance — making harness selection a governed, enforceable decision instead of declarative-inert + dynamic-unchecked. Design spec: docs/plans/harness-governance.md. All additive (empty policy = today's behavior exactly), gate green (make check + ruff + 393 pytest, +48 over baseline).

What shipped

• T0010 — per-harness governance fields in the registry (capability_tags, cost_tier, autonomy_class, auth_requirement, health_probe, drift markers), empty-safe; frozen probe/field/oneshot verbs untouched.
• T0011 — harness-registry roster + health CLI verbs (additive; the test fake learns them).
• T0012 — HarnessPolicy on EngineConfig (allow/deny, cost ceiling, autonomy cap, role↔tag map); defaults reproduce today.
• T0013 — classify_harness gate pass (pure; roster=None default = no change) — the same defense-in-depth shape as the security gate, applied to harness choice.
• T0014 — boot-time brain/ingest harness validation + the harness roster & selection rubric in the brain prompt.

Dogfooded — built by loop-orchestrator orchestrating itself

This was built by a self-hosted govern loop session (claude brain, isolated worktree so it couldn't touch the live daemons), through a live dual-vendor model outage (Claude Fable 5 + codex both went unavailable mid-build) — it failed over to a sonnet brain + opus build lane and lost zero project state, validating the stateless-boot continuity model under real duress.

Findings the dogfood surfaced (in docs/board/harness-governance.md) — Phase 2 inputs

• F1 — governance must validate dispatch/steer targets (agent vs shell lane), not only add_lane harness choice.
• F2 — post-relaunch in-session context loss.
• F3 — model-unavailable should be its own failure_kind; registry should support per-harness model failover; availability is per-(harness, model).
• F4 — the brain self-authorized a deferred/sign-off-gated phase; objective-fences should make crossing into a deferred phase an escalate/block, not a brain judgment call.

Deferred (needs sign-off — not in this PR)

Phase 2 (per-harness readiness/health contract — the linchpin, touches the frozen status contract) and Phases 3–5 (deck, conditional worktree isolation, lane handoff). Build the governance now; buy the parallelism machinery only when concurrency > 1.

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request implements Phase 0 and Phase 1 of the Multi-Harness Agent Governance plan, adding per-harness governance fields, policy configurations, gate classification, boot-time validation, and a selection rubric in the brain prompt. The review feedback highlights several robustness improvements, including preventing a boot-time crash when a harness is empty, avoiding string formatting issues where explicit null values could format as "None", and escaping double quotes in the bash-based roster CLI to prevent malformed JSON generation.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[gemini-code-assist]

If harness is configured as None or an empty string in the YAML configuration, passing it directly to substrate.harness_field will result in a TypeError inside subprocess.run (since None is not a valid argument type). This TypeError is not caught by the except SubstrateError block, causing the engine to crash at boot. Adding a check for falsy/empty values prevents this crash.

    for label, harness, override_var in checks:
        if not harness:
            failures.append(f"{label}.harness is empty or not specified")
            continue
        if allow and harness not in allow:

[gemini-code-assist]

Using str(entry.get("capability_tags", "")) converts an explicit None (parsed from JSON null) into the string "None". This can lead to unexpected behavior when matching tags. Using entry.get("capability_tags") or "" is safer and more robust.

Suggested change

	tags = set(str(entry.get("capability_tags", "")).split(","))
	tags = set((entry.get("capability_tags") or "").split(","))

[gemini-code-assist]

If any of the registry fields (like capability_tags, cost_tier, etc.) are explicitly None (parsed from JSON null), entry.get(..., '') will return None, which then formats as "None" in the brain prompt. Using or '' instead of , '' ensures they default to empty strings.

Suggested change

	lines.append(
	f"{name} tags={entry.get('capability_tags', '')} "
	f"cost={entry.get('cost_tier', '')} autonomy={entry.get('autonomy_class', '')} "
	f"drift={entry.get('drift_pins', '')}"
	)
	lines.append(
	f"{name} tags={entry.get('capability_tags') or ''} "
	f"cost={entry.get('cost_tier') or ''} autonomy={entry.get('autonomy_class') or ''} "
	f"drift={entry.get('drift_pins') or ''}"
	)

[gemini-code-assist]

The JSON roster generation uses plain printf interpolation. While most fields are static identifiers, health_probe is a shell command and is highly likely to contain double quotes (e.g., pgrep -f "process" or curl -H "Auth..."). If it does, the generated JSON will be malformed. Escaping double quotes in health_probe prevents this.

Suggested change

	printf ' {"name": "%s", "present": %s, "capability_tags": "%s", "cost_tier": "%s", "autonomy_class": "%s", "auth_requirement": "%s", "health_probe": "%s", "drift_pins": "%s"}' \
	"$n" "$present" \
	"$(harness_field "$n" capability_tags)" \
	"$(harness_field "$n" cost_tier)" \
	"$(harness_field "$n" autonomy_class)" \
	"$(harness_field "$n" auth_requirement)" \
	"$(harness_field "$n" health_probe)" \
	"$(harness_field "$n" drift_pins)"
	local probe
	probe="$(harness_field "$n" health_probe)"
	printf ' {"name": "%s", "present": %s, "capability_tags": "%s", "cost_tier": "%s", "autonomy_class": "%s", "auth_requirement": "%s", "health_probe": "%s", "drift_pins": "%s"}' \
	"$n" "$present" \
	"$(harness_field "$n" capability_tags)" \
	"$(harness_field "$n" cost_tier)" \
	"$(harness_field "$n" autonomy_class)" \
	"$(harness_field "$n" auth_requirement)" \
	"${probe//\"/\\\"}" \
	"$(harness_field "$n" drift_pins)"