惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

Y
Y Combinator Blog
Security Archives - TechRepublic
Security Archives - TechRepublic
钛媒体:引领未来商业与生活新知
钛媒体:引领未来商业与生活新知
Apple Machine Learning Research
Apple Machine Learning Research
Blog — PlanetScale
Blog — PlanetScale
OSCHINA 社区最新新闻
OSCHINA 社区最新新闻
G
Google Developers Blog
F
Full Disclosure
大猫的无限游戏
大猫的无限游戏
酷 壳 – CoolShell
酷 壳 – CoolShell
T
Threat Research - Cisco Blogs
A
Arctic Wolf
Threat Intelligence Blog | Flashpoint
Threat Intelligence Blog | Flashpoint
The Cloudflare Blog
博客园 - 【当耐特】
AWS News Blog
AWS News Blog
U
Unit 42
V
Vulnerabilities – Threatpost
P
Privacy International News Feed
T
Tor Project blog
Microsoft Security Blog
Microsoft Security Blog
宝玉的分享
宝玉的分享
Google DeepMind News
Google DeepMind News
爱范儿
爱范儿
cs.CL updates on arXiv.org
cs.CL updates on arXiv.org
Recorded Future
Recorded Future
freeCodeCamp Programming Tutorials: Python, JavaScript, Git & More
奇客Solidot–传递最新科技情报
奇客Solidot–传递最新科技情报
C
CXSECURITY Database RSS Feed - CXSecurity.com
T
Threatpost
Latest news
Latest news
GbyAI
GbyAI
S
SegmentFault 最新的问题
MongoDB | Blog
MongoDB | Blog
N
Netflix TechBlog - Medium
Hacker News: Ask HN
Hacker News: Ask HN
美团技术团队
N
News | PayPal Newsroom
J
Java Code Geeks
Exploit-DB.com RSS Feed
Exploit-DB.com RSS Feed
Microsoft Azure Blog
Microsoft Azure Blog
K
KPMG report finds enterprise disconnect between AI and its ROI | CIO
The Hacker News
The Hacker News
The GitHub Blog
The GitHub Blog
V
V2EX
N
News and Events Feed by Topic
T
Troy Hunt's Blog
Security Latest
Security Latest
博客园 - 叶小钗
P
Palo Alto Networks Blog

DEV Community

Authentication Security Deep Dive: From Brute Force to Salted Hashing (With Java Examples) Why AI Systems Don’t Fail — They Drift Spilling beans for how i learn for exam😁"Reinforcement Learning Cheat Sheet" I Replaced Chrome with Safari for AI Browser Automation. Here's What Broke (and What Finally Worked) How Python Borrows Other People's Work The $40 Architecture: Processing 1 Billion API Requests with 99.99% Uptime Vibe Coding: A Workflow Guide (From Zero to SaaS) Most webhook security guides protect the wrong side. The scary part is delivery. Headless CMS for TanStack Start: Build a Blog with Cosmic EU Age Verification App "Hacked in 2 Minutes" — What Actually Happened Comfy Cloud’s delete function does not actually remove files Running AI Models on GPU Cloud Servers: A Beginner Guide Event-driven media intelligence with AWS Step Functions and Bedrock I scored 500 AI prompts across 8 quality dimensions — here's what broke How to Call Google Gemini API from Next.js (Free Tier, No Backend Needed) The Portal Protocol: Reclaiming Human Connection in the Age of AI How to Fix Your Team's Scattered Knowledge Problem With a Self-Hosted Forum Intro to tc Cloud Functors: A Graph-First Mental Model for the Modern Cloud Designing Multi-Tenant Backends With Both Ownership and Team Access I Built a Neumorphic CSS Library with 77+ Components — Here's What I Learned PostgreSQL Performance Optimization: Why Connection Pooling Is Critical at Scale Cómo construí un SaaS multi-rubro para gestionar expensas en Argentina con FastAPI + Vue 3 🚀 I Built an Ethical Hacking Scanner Tool – Open Source Project I Replaced /usage and /context in Claude Code With a Single Statusline A Pythonic Way to Handle Emails (IMAP/SMTP) with Auto-Discovery and AI-Ready Design I Collected 8.9 Million Polymarket Price Points — Here's What I Found About How Markets Really Move EcoTrack AI — Carbon Footprint Tracker & Dashboard Everyone's Using AI. No One Agrees How. 5 self-hosted ebook managers worth trying in 2026 Building Your First AI Agent with LangChain: From Chatbot to Autonomous Assistant Common SOC 2 Failures (Real World) Stop Vibe-Checking Your AI App: A Practical Guide to Evals How to Use SonarQube and SonarScanner Locally to Level Up Your Code Quality Your Next To-Do App Is Dead — I Replaced Mine with an OpenClaw AI Sign a Nostr event in 60 lines of Python using coincurve — no nostr-sdk, no nbxplorer, no rust toolchain ITGC Audit Explained Like You’re in Big 4 Patch Tuesday abril 2026: Microsoft parcha 163 vulnerabilidades y un zero-day en SharePoint Stop scraping everything: a better way to track competitor price changes Listing on MCPize + the Official MCP Registry while routing payments OUTSIDE the marketplace — how I kept 100% of my x402 revenue Building an AI-Powered Risk Intelligence System Using Serverless Architecture Why We Ripped Function Overloading Out of Our AI Toolchain Testing AI-Generated Code: How to Actually Know If It Works SaaS Churn Is Killing Your Business. Here Is What to Do About It (Without a Support Team) The Speed of AI Is No Longer Linear - And Self-Improving Models Are Why How to Implement RBAC for MCP Tools: A Practical Guide for Engineering Teams From Standard Quote to Persuasive Proposal: AI Automation for Arborists I built a CLI that scaffolds complete multi-tenant SaaS apps Axios CVE-2025–62718: The Silent SSRF Bug That Could Be Hiding in Your Node.js App Right Now The dashboard that ended our friendship Data Pipelines Explained Simply (and How to Build Them with Python) The Hidden Cost of AI Systems Nobody Talks About. undefined vs undeclared, and how typeof behaves Switching from file-based jobs to NATS/Kafka in Rust without changing code io_uring Adventures: Rust Servers That Love Syscalls Why Agentic AI is Killing the Traditional Database The POUR principles of web accessibility for developers and designers Quantum Neural Network 3D — A Deep Dive into Interactive WebGL Visualization How To Install Caveman In Codex On macOS And Windows Automation Pipeline Reliability: Why Your Workflow Breaks When Nobody Is Watching I Built an 'Open World' AI Coding Agent — It Works From ANY Folder From Freelancing to Product: A Tech Service Company's SaaS Transformation China's AI Giants: Adding Tencent Hunyuan & ByteDance Doubao to AI University (74 Providers) On the Vibe Coders and Their Lies clerk: Auto-Summarize Your Claude Code Sessions AI Weekly — 2026/04/10–04/17 | The Model Lockdown Is Here, but the Toolchain Is the Real Battleground AI 週報 — 2026/04/10–2026/04/17 模型封鎖潮來了,但工具鏈才是真戰場 Maybe this is how Open-Source apps are born... 🚀 Fine-Tune LLMs with LoRA and QLoRA: 2026 Guide tRPC v11 + Next.js App Router: End-to-End Type Safety Without the Boilerplate ShadCN UI in 2026: Why I Stopped Installing Component Libraries and Started Owning My Components SaaS Billing in React Server Components: Stripe + Supabase Without a Single `useEffect` Join our DEV Weekend Challenge — $1,000 in Prizes Across TEN winners! Submissions Due April 20 at 6:59 AM UTC. Implementing FSRS Spaced Repetition in Flutter + Supabase — Adding Memory Science to an AI Learning App "I Texted My Localhost From the Train — Claude Code Fixed the Bug Before I Got Home" I Built a Sales Prep AI and It Went Deeper Than Expected Design to Code #2: One JSON, Eleven Outputs Solving the 100M-Row Problem: A Summary Table Pattern for High-Volume Push Notification Logs Flutter Web With Wasm: What Actually Changes For Developers I Built 50 Royalty-Free Soundtracks for My Side Project in a Weekend Using AI Music Generation The Vibe Coding Security Checklist: 7 Things to Check Before You Ship Stop Letting Googlebot Guess Fix Your React App's SEO Right Desconstruindo o Streaming do LinkedIn: Como Criar um Engine de Extração de Vídeo de Alta Performance com HLS e FFmpeg (EDA Part-1) EDA (Exploratory Data Analysis) Explained With Real Life — Why Looking at Your Data Is the Most Important Step in Machine Learning Brand Relationship Management at Scale: Our 4-Touch Outreach System for 200+ Brands Why String.fromEnvironment() Might Return an Empty String in Dart JGuardrails 1.0.0 — Hardening Java LLM Apps Against Jailbreaks, Toxicity, and Prompt Injection Plan and Schedule a Full Week of Threads Content From One Claude Conversation Coding Cat Oran Ep3, Five Tables Changed Everything Updated: BFF Pattern I'm done watching freelancers get buried by 200 proposals. So I'm building the alternative. This is my first post BFS Algorithm in Java Step by Step Tutorial with Examples Tracking LLM Pricing Monthly: An Open Dataset for 22 AI Models How We Measure Content ROI on a Comparison Site: Revenue Attribution Without Perfect Data Introducing Nova AI Ops: The AI-Native Operating System for SRE Teams I built a free desktop video downloader for Windows — Grabbit How Talkie OCR Helps Vision-Impaired & Dyslexic Users Read the World Around Them VRCFaceTracking安装和iPhone面捕配置教程,有bug Even CrowdStrike Can't See Your Agents The Automation Gold Rush: What n8n Workflows and Claude Are Opening Up for Developers Right Now
What Is Harness Engineering? A Builder's Guide
Remy B. · 2026-04-29 · via DEV Community

Key Takeaways

  • Harness engineering is designing the environment, constraints, and feedback loops that make AI coding agents reliable
  • The core formula: Agent = Model + Harness — the model is just one piece of the system
  • Three regulation types: maintainability, architecture fitness, and behavior
  • LangChain improved agent accuracy from 52.8% to 66.5% by changing only the harness — same model
  • A solid harness includes context files, static analysis, automated tests, reusable skills, and living documentation

92% of developers now use AI coding tools daily. Yet trust in AI-generated code has dropped — from 77% to 60% in just one year. The models keep getting better. The output keeps getting less trusted. Something else is the bottleneck.

That something is the harness — the model is one part of a reliable system, and everything around it determines whether the output is trustworthy. The term has a name now: harness engineering.

The first time I hit unreliable AI output on a real project, I did what most people do — I upgraded the model. Cursor to Claude Opus to GPT-5. Three days, three model swaps, same drift: hallucinated imports, ignored conventions, the same bug fixed three different ways. The fix wasn't a smarter model. It was an AGENTS.md file with my project's conventions, a pre-commit hook running tests, and a feature spec template I'd been skipping. Twenty minutes of setup, and the next agent run shipped clean on the first try. The model was never the bottleneck.

If you've been vibe coding and your AI tools produce great results sometimes and unreliable ones other times, harness quality is why.

What Is Harness Engineering?

Harness engineering is the practice of designing everything around an AI model that makes it work reliably: the context it receives, the tools it can call, the checks that verify its work, and the feedback loops that correct its mistakes.

The metaphor comes from horse tack. Reins, saddle, bit, and bridle don't limit a horse's power — they channel it in a specific direction. Harness engineering does the same for AI: it preserves the speed and capability of the model while directing it toward consistent, trustworthy output.

The Origin of the Term

The concept crystallized in early 2026 through three landmark publications:

  • Mitchell Hashimoto (co-founder of HashiCorp, creator of Terraform) described "Engineer the Harness" as Step 5 of his AI adoption journey in February 2026: anytime an agent makes a mistake, you engineer a solution so it never makes that mistake again.
  • OpenAI published "Harness engineering: leveraging Codex in an agent-first world," describing how their team built a production application with 1M+ lines of code where zero lines were written by human hands.
  • Birgitta Boeckeler (Distinguished Engineer at Thoughtworks) wrote the definitive practitioner article on martinfowler.com in April 2026, establishing the theoretical framework that the industry now references.

Within weeks, the term went from niche to mainstream. Unlike previous buzzwords, harness engineering solved a problem every AI-using developer was already feeling: the gap between what AI models can do and what they reliably do.

The Formula — Agent = Model + Harness

LangChain put it most simply: Agent = Model + Harness. The model is what thinks. The harness is everything else — the context the model receives before working, the tools it can access, the schemas that constrain its output, and the checks that verify what it produced.

Most teams optimize the model. They upgrade to GPT-5, switch to Claude Opus, try Gemini 2.5. The highest-leverage teams optimize the harness instead.

LangChain improved their agent accuracy from 52.8% to 66.5% by ONLY changing the harness — same model, same prompts, 14-point jump. Two teams using the same model can see a 40-point difference in task completion rates based on harness quality alone.

This is the core insight: the harness matters more than the model. If your AI coding workflow is unreliable, the fix probably isn't a better model. It's a better harness.

Why AI Agent Reliability Depends on the Harness

AI models in 2026 are dramatically more capable than they were a year ago. So why has trust in AI-generated code actually decreased?

The reliability gap

Trust in AI-generated code dropped from 77% to 60% year over year — despite models getting dramatically better. The bottleneck has shifted from model capability to harness maturity.

The pattern is consistent across teams and tools: AI agents fail not because models are bad, but because harnesses are missing. Without constraints, a capable model will solve the immediate problem in whatever way seems locally optimal — ignoring your project's conventions, duplicating existing utilities, introducing inconsistent error handling, and creating security gaps it doesn't know to check for.

This is why AI agent reliability is fundamentally a harness problem, not a model problem. A well-harnessed agent with a mid-tier model outperforms an unharnessed agent with the best model available. The infrastructure around the AI determines the output quality more than the AI itself.

How Harness Engineering Works — Guides and Sensors

Boeckeler's framework on martinfowler.com breaks a harness into two complementary control types. Understanding these makes the concept immediately practical.

Guides (Feedforward Controls)

Guides steer the agent before it starts working. They shape what the agent knows, what it can do, and what it should prioritize.

  • Computational guides: AGENTS.md files, CLAUDE.md, .cursorrules, TypeScript schemas, project templates, API contracts. These are deterministic — the agent reads them and incorporates them into its context.
  • Inferential guides: Planner agents, sub-agents that decompose tasks before the main agent generates code. These use LLM reasoning to provide richer, more contextual guidance.

Guides are the proactive layer. They prevent mistakes by giving the agent the right information upfront — your architecture, your conventions, your constraints. Tools like Claude Code, Cursor, and Windsurf all support guide mechanisms, but few developers set them up beyond a basic rules file.

Sensors (Feedback Controls)

Sensors check the agent's work after it generates output. They catch what the guides didn't prevent.

  • Computational sensors: Automated tests, type-checking, linting, security scanning, coverage thresholds. These are fast, deterministic, and non-negotiable.
  • Inferential sensors: Evaluator agents that review generated code for architectural fit, code review bots, and AI-powered quality checks that assess output semantically.

The most effective harnesses use both types together. Guides reduce the error rate; sensors catch what slips through. Neither alone is sufficient.

Guides (Feedforward) Sensors (Feedback)
Computational AGENTS.md, templates, schemas, type definitions Tests, type-checking, linting, security scanning
Inferential Planner agents, task decomposition, sub-agents Evaluator agents, AI code review, quality assessment
When they run Before generation After generation
Failure mode Agent ignores or misinterprets guidance Bad output passes undetected
Example CLAUDE.md says "use Prisma for all DB access" Type-checker rejects raw SQL query in a Prisma-only codebase

Three Things a Harness Regulates

Not all harness engineering problems are the same. Boeckeler identifies three distinct regulation categories, each targeting a different type of failure.

Maintainability

The most mature category. Maintainability harnesses ensure AI-generated code follows your project's patterns, naming conventions, file structure, and coding standards consistently. This is where pattern drift — the #1 scaling problem in AI-assisted development — gets solved at the infrastructure level rather than through manual review.

Tools: linters with custom rules, AGENTS.md with architectural context, enforced directory structures, code generation templates.

Architecture Fitness

Ensuring AI output fits your project's architecture: dependency boundaries, module structure, API contracts, performance budgets. This prevents the subtle failures where AI code works in isolation but breaks the system's design.

Tools: architecture decision records, dependency constraints, integration tests, module boundary checks.

Behavior

The least mature and hardest category. Behavior harnesses verify that the code does what it should and doesn't do what it shouldn't. This is where functional correctness, security validation, and edge case coverage live.

Tools: comprehensive test suites, property-based testing, security scanning, end-to-end validation.

AI Coding Guardrails — The Practical Layer

AI coding guardrails are the most tangible expression of harness engineering. They're the automated checks that run regardless of which AI tool generated the code and regardless of the developer's intent. Where guides are suggestions, guardrails are enforcement.

What Makes a Good Guardrail

  • Fast — under 30 seconds. If a guardrail is slow, developers will skip it.
  • Deterministic — same input produces same result. No flaky checks.
  • Actionable — when it fails, the error message tells you what to fix.
  • Non-bypassable — integrated into the workflow so skipping requires conscious effort.

Your First Harness — A Practical Checklist

You don't need an enterprise orchestration platform to start harness engineering. Here's what a solid starting harness looks like for a solo developer or small team — regardless of language or framework:

  1. An AGENTS.md or CLAUDE.md file with your project's conventions, architecture, and patterns. Keep it concise and human-written — research from ETH Zurich shows AI-generated context files actually hurt performance. This is the single highest-leverage guide you can add.
  2. Strict static analysis and linting. TypeScript strict mode, mypy/pyright for Python, ESLint, Ruff — whatever fits your stack. Turn on the strictest settings your team can tolerate. These catch type errors, style drift, and common mistakes automatically, so you don't waste review cycles on things a machine should handle.
  3. Automated tests that run on every change. Unit tests at minimum, integration tests where it matters. Wire them into a pre-commit hook or CI pipeline so untested code can't ship. This is your most important sensor.
  4. A feature spec template — a lightweight PRD that defines what a feature should do before you prompt the AI. This converts vague intent into structured guidance and dramatically improves first-attempt quality.
  5. Security scanning. Run a SAST tool (Semgrep, Bandit, or equivalent) in your pipeline. AI-generated code has a documented tendency to introduce vulnerabilities — automated scanning catches the most common ones before they reach production.

Beyond the Basics — Skills, Agents, and Living Documentation

The checklist above gets you a functional harness. The next level is making your harness adaptive — so it scales as your project grows and your AI workflows get more complex.

  • Reusable skills. Instead of repeating complex instructions in every prompt, encode common workflows as structured skills the agent can invoke — "add an API endpoint," "create a database migration," "write integration tests for this service." Skills are guides with progressive disclosure: the agent gets the right knowledge at the right time, rather than drowning in a massive context file.
  • Specialized sub-agents. A single general-purpose agent trying to do everything — code, review, test, plan — is a weak harness. Splitting responsibilities across focused agents (a planner, a coder, a reviewer, a security auditor) means each one operates within a narrower scope with clearer constraints. This is how both OpenAI and Anthropic structure their production AI systems.
  • Living documentation. Static docs go stale the moment code changes. A mature harness includes auto-generated documentation that stays in sync with the codebase — so every feature, API endpoint, and architectural decision is always available as context for the next AI task. Without this, your AGENTS.md gradually drifts from reality, and the harness degrades.
  • AI-ready architecture. Clear module boundaries, well-defined API contracts, consistent file structure, and explicit dependency rules. When your codebase is organized so that a human can understand any feature by reading two or three files, an AI agent can too. Architecture that's easy for agents to navigate is also easier for your team to maintain.

Building Your First Harness — A Practical Path

Harness engineering isn't something you implement all at once. It's an iterative process that improves every time an agent fails and you add a new constraint.

  1. Define your conventions. Write an AGENTS.md or CLAUDE.md that describes your project's architecture, patterns, and standards. This is your first guide.
  2. Set up automated checks. Tests, strict type checking, lint rules, security scanning. Every check you add is a sensor that catches mistakes the model will inevitably make. Start with the checks that matter most for your project.
  3. Use spec-driven workflows. Don't let the agent start from a vague prompt. Define what the feature should do before you ask the AI to build it.
  4. Close the feedback loop. Every time an agent produces a bad result, ask: "What guide or sensor would have prevented this?" Then add it. The harness improves incrementally — and each improvement prevents an entire class of future failures.

Anytime you find an agent makes a mistake, you take the time to engineer a solution such that the agent never makes that mistake again. — Mitchell Hashimoto

This is the core practice of harness engineering: not accepting AI mistakes as the cost of speed, but systematically eliminating them through infrastructure.


Originally published on VibeReady. Republished here for the dev.to community.