/tui
The state layer exists because one context window is not enough. The harness is the other half of that problem: a terminal built for work measured in days rather than turns, with continuity and identity native to it instead of reached through someone else’s client.
being built · not released · a posture, not a spec
already true
These run today, in the system we build with. They are the parts of the posture that do not depend on the harness shipping.
If a model emits a key in its output, it is replaced with a fingerprint at the log seam — before the turn reaches the floor. It covers the known credential formats; it is a finite registry, not a promise about every secret that could exist.
Every path is resolved against the project root and checked rather than trusted: traversal, absolute paths onto another drive, and symlink escapes are refused instead of followed.
An agent is registered with either an explicit list of what it may do, or an explicit unrestricted marking that a human had to accept. One with neither is refused at creation rather than defaulted into.
Spawned processes are registered with a verified OS identity and a parent, and their termination is recorded rather than assumed — so a dead worker is known to be dead instead of presumed.
Authoring runs against a separate clone. If the destination already exists it refuses, rather than reusing or overwriting it.
If no model is declared for a lane and no override is given, it stops. The failure direction is a refusal, not a default — the same posture as everything above it.
not yet
Designed, not shipped — and listed in that tense on purpose. A security page that blurs the two is worth less than one that admits the line.
Process-group and restricted-token containment, so the boundary is enforced by the operating system rather than by the agent’s good behaviour.
Keys held in the OS keychain, bound to their origin and injected at the request layer, so the model never handles the material at all — rather than handling it and being redacted afterwards.
Permissions today are declared at creation. The gate that pauses a specific action, asks, and remembers the answer for the session is designed and not yet built.
A snapshot taken before a destructive change, with restore and diff. Today the recorded recovery path covers the launch stack, not your working tree. Until that ships, treat the harness as capable of changing files you care about.
your keys
Models are interchangeable seats, not a vendor lock. Bring your own key, or sign in with OAuth where the provider’s terms permit it.
That second clause is a constraint we are choosing. We would rather ship a narrower set of integrations than route your account through something its terms don’t allow — a harness that quietly breaks a provider’s rules on your behalf is a liability wearing the costume of a feature.
commitments
No destructive operation without a recoverable path — and where recovery does not exist yet, we say so rather than implying it does.
No credential material reaching the model, once the vault replaces redaction as the primary defence.
No unbounded autonomy. Long-running work is the point, but it runs inside a boundary a human set.
No silent failure. A refusal is loud, and an unknown says unknown.