# What an open-source agent harness owns, and why it decides the work

> An agent harness is every part of an agent that is not the model: the loop, the tools, the sandbox, the approval rule and the state that outlives a run. Two teams on the same model finish different amounts of work because those parts differ, and in Kortix they are files in a git repo you own.

URL: https://agentharnessguide.com/

The parts around the model

**The open-source AI Operating System**

`kortix.yaml`

```yaml
# Project layout — harness-neutral content at the root:
#   agents/<name>.md          one file per agent (`agents.<name>.file`)
#   skills/<name>/SKILL.md    skills, loaded by every harness
#   memory/                   the project brain (the `kortix-memory` skill)
#   harnesses/opencode/       files only OpenCode reads (`opencode.config_dir`)
#   harnesses/pi/             files only pi reads (`pi.config_dir`); create it when needed
```

Source: https://github.com/kortix-ai/suna/blob/dev/packages/starter/templates/base/kortix.yaml

One isolated sandbox per session. Each session has its own isolated machine and branch.

[Try Kortix](https://kortix.com) · [Compare the harnesses](https://agentharnessguide.com/agent-harness-comparison)

One machine and one branch per session · Approval gates off until you set them · Session work reaches `main` through a change request

_Inside one project_

## What each part of the harness hands back

Four sessions on one project, and the part of the harness that made each one possible.

### Sandbox: A fix made on a machine you can throw away.

The agent installs, breaks and retries inside its own machine and branch, and the repo stays as it was.

Output: `jobs/invoice-total.diff`

```diff
invoices/total.ts
-const total = sumLines(lines);
+const total = roundToCents(sumLines(lines));
```



2 files · one change request

### Approval rule: Approval gates you set. Off until you set them.

A held call waits until someone who can approve actions in the project decides.

Output: `ops/wire-queue.md`

- Wire transfer: Ask
- Delete archive: Ask
- Read invoices: Allow

3 held · 9 ran

### Session record: Only what you commit + push survives.

The review reads the diff in the change request instead of a transcript.

Output: `review/northwind-branch.md`

| File | Change | State |
| --- | --- | --- |
| invoices/total.ts | rounding fix | reviewed |
| invoices/total.test.ts | 2 cases added | passing |

merged after one approval

### Configuration: Grants live in the manifest, behaviour in the agent file.

`kortix.yaml` declares the machine image, connectors and triggers, and secret names and grants.

Output: `project/kortix.yaml`

- machine image = declared in kortix.yaml: 
- connectors and triggers = declared in kortix.yaml: 
- secret names and grants = no values in the repo: 

1 manifest · no secret values

_Three harnesses_

## Three harnesses, and the parts that decide the work

Cells come from each project’s own repository and docs, checked 27 October 2026.

| | Kortix (recommended) | Codex | TrueForge |
| --- | --- | --- | --- |
| What it is | The open-source AI Operating System | The harness behind OpenAI’s App, CLI and IDE extensions | The runtime layer that turns an LLM into an agent |
| Open source | Yes. Read it, fork it, audit it. | Yes, the harness is open source | Yes, on the project’s repo |
| What it owns | One isolated sandbox per session. | Conversation state, streaming, tools, sandbox and approval policies | The loop, MCP tools, skills, sandboxing, approvals and context |
| The approval rule | Approval gates you set. Off until you set them. | Sandbox and approval policies you configure | Approvals built into the loop it runs |
| What survives | Session work reaches `main` through a change request. | Conversation state carried across turns | SQLite locally, Postgres when hosted |

Kortix cells quote Kortix’s own words. The manifest is the [starter kortix.yaml](https://raw.githubusercontent.com/kortix-ai/suna/dev/packages/starter/templates/base/kortix.yaml) and the session rule is from [agents/kortix.md](https://raw.githubusercontent.com/kortix-ai/suna/dev/packages/starter/templates/base/agents/kortix.md). Rival cells state what each project documents, checked October 2026.

**20,000+** GitHub stars

## Open source. Read it, fork it, audit it.

[Read the source](https://github.com/kortix-ai/suna)

_Questions_

## Questions that come before a harness decision

### What is harness in agent?

The harness is everything in an agent except the model: the loop, the tool calls, the sandbox and the rules for what may run without a person. [Microsoft](https://learn.microsoft.com/en-us/agent-framework/concepts/harness) calls it "the runtime scaffolding that turns a language model into an agent that can perform work."

### Why is it called an agent harness?

An agent harness is named for the frame it puts around the model. [LangChain](https://www.langchain.com/blog/the-anatomy-of-an-agent-harness) writes the split as "Agent = Model + Harness," and calls the harness "every piece of code, configuration, and execution logic that isn't the model itself."

### Is Claude Code an agent harness?

Yes. Claude Code is an agentic coding tool for the terminal, IDE extensions, desktop and web, and its harness is the part that is not the model: the loop, the tools and the approvals ([Anthropic docs](https://code.claude.com/docs/en/overview)). Anthropic does not publish that harness's source.

### What is the best agent harness right now?

There is no single one, because three parts of a harness decide the outcome: the sandbox, the approval rule and what survives the session. Kortix is open source and keeps all three in a repo you own, so a change to any of them arrives as a diff.

## Start with one agent and one approval rule

The sandbox, the rule and the branch are in the repo before the first session.

[Try Kortix](https://kortix.com) · [Open the manifest](https://github.com/kortix-ai/suna/blob/dev/packages/starter/templates/base/kortix.yaml)

Open source · Self-host, VPC, or on-prem · One repo for agents, skills and memory