The parts around the model
The open-source AI Operating System
An agent harness is every part of an agent that is not the model: the loop, the tools, the sandbox, the approval rule and the state that outlives a run. Two teams on the same model finish different amounts of work because those parts differ, and in Kortix they are files in a git repo you own.
One machine and one branch per session · Approval gates off until you set them · Session work reaches main through a change request
# Project layout — harness-neutral content at the root: # agents/<name>.md one file per agent (`agents.<name>.file`) # skills/<name>/SKILL.md skills, loaded by every harness # memory/ the project brain (the `kortix-memory` skill) # harnesses/opencode/ files only OpenCode reads (`opencode.config_dir`) # harnesses/pi/ files only pi reads (`pi.config_dir`); create it when needed
Inside one project
Four sessions on one project, and the part of the harness that made each one possible.
Sandbox
The agent installs, breaks and retries inside its own machine and branch, and the repo stays as it was.
Approval rule
A held call waits until someone who can approve actions in the project decides.
Session record
The review reads the diff in the change request instead of a transcript.
| File | Change | State |
|---|---|---|
| invoices/total.ts | rounding fix | reviewed |
| invoices/total.test.ts | 2 cases added | passing |
Configuration
kortix.yaml declares the machine image, connectors and triggers, and secret names and grants.
Three harnesses
Cells come from each project’s own repository and docs, checked 27 October 2026.
| Criteria | Kortix | Codex | TrueForge |
|---|---|---|---|
| What it is | The open-source AI Operating System | The harness behind OpenAI’s App, CLI and IDE extensions | The runtime layer that turns an LLM into an agent |
| Open source | Yes. Read it, fork it, audit it. | Yes, the harness is open source | Yes, on the project’s repo |
| What it owns | One isolated sandbox per session. | Conversation state, streaming, tools, sandbox and approval policies | The loop, MCP tools, skills, sandboxing, approvals and context |
| The approval rule | Approval gates you set. Off until you set them. | Sandbox and approval policies you configure | Approvals built into the loop it runs |
| What survives | Session work reaches `main` through a change request. | Conversation state carried across turns | SQLite locally, Postgres when hosted |
Kortix cells quote Kortix’s own words. The manifest is the starter kortix.yaml and the session rule is from agents/kortix.md. Rival cells state what each project documents, checked October 2026.
Questions
The harness is everything in an agent except the model: the loop, the tool calls, the sandbox and the rules for what may run without a person. Microsoft calls it "the runtime scaffolding that turns a language model into an agent that can perform work."
An agent harness is named for the frame it puts around the model. LangChain writes the split as "Agent = Model + Harness," and calls the harness "every piece of code, configuration, and execution logic that isn't the model itself."
Yes. Claude Code is an agentic coding tool for the terminal, IDE extensions, desktop and web, and its harness is the part that is not the model: the loop, the tools and the approvals (Anthropic docs). Anthropic does not publish that harness's source.
There is no single one, because three parts of a harness decide the outcome: the sandbox, the approval rule and what survives the session. Kortix is open source and keeps all three in a repo you own, so a change to any of them arrives as a diff.
The sandbox, the rule and the branch are in the repo before the first session.
Open source · Self-host, VPC, or on-prem · One repo for agents, skills and memory