Safety is a property of the harness
What one person's agent fleet can and cannot enforce — the principles, the mechanisms, four incidents, and the gaps · Macheng Shen × agent · 2026-09-07
The claim
Most public discussion of AI safety is about models: what a system of weights believes, intends, or can be induced to say. This section is about the other half — the harness. The scaffolding around the model: what it is permitted to touch, what it must prove before touching it, who can authorise it, what is recorded when it acts, and what happens when it is told to stop.
The claim here is narrow and I would like it read narrowly. It is not that alignment research on models is unnecessary. It is this: for a persistent, multi-agent, personally-owned system, most of the safety surface that is actually reachable in 2026 is harness surface — and that surface can be built, instrumented, broken, and published by one person with a laptop and a fleet of agents, without waiting for anyone's permission and without frontier-scale stakes.
Cognitive state of that thesis: speculative. It is a position that has produced running mechanisms and four written-up failures, not a result that has survived a stress test designed to kill it. The kill conditions are published, which is the most I can offer.
The one convention that makes the rest of this section readable. Every mechanism named anywhere here carries one of two badges, and the badge is part of the claim, not decoration:
running— there is code that enforces it, and the enforcement point can be named.specified— there is a written design. No public code enforces it, or the code that exists does not enforce this part.
A third qualifier, private, marks a mechanism running inside the author's own fleet but not published. This is the same discipline the rest of this site applies to beliefs with survived / speculative / retired — applied to code instead.
Why the badge exists
Because this project failed its own test, and the failure was found while writing this section. Auditing the public repositories on the day of publication turned up three things: a safety charter in architecture-v1 stating six hard mechanisms whose companion implementation, reference-impl, enforces none of the last five and contradicts the first at both ends — provenance is optional on write, and the update endpoint overwrites the very field the charter declares write-once; a signed authority envelope in starshard-communication whose shipped example file says, in its own comment, "DESIGNED, not implemented"; and agent-continuity-demo, whose one-line description advertises four coordination primitives its own README explicitly disclaims three of.
That is exactly the disease the rest of this section describes: a claim checked against a document instead of against the running thing. It would have been easy to quietly correct the READMEs first and publish a clean page. The mechanism layer reports the gap instead, because a safety page that silently repaired its own overclaims while lecturing about verification would be worth nothing.
The section
- Principles a harness can enforce — the bright lines, the pre-cleared ship envelope and the predicate an incident forced onto it — the gate was not bypassed, it was satisfied — stop as an absorbing state, and the rule that authority may only attenuate as it is delegated. The organising distinction: a principle an agent is asked to remember, versus a principle a mechanism enforces. Only the second kind survives contact with a system that has been running for a year.
- What is actually running — the gates, ledgers, leases, budgets and verifiers, each with the failure class it prevents and an honest status. Includes the ones that are embarrassing: an approval gate sitting in shadow mode that blocks nothing, a per-action re-verification guard wired into one tool out of nine, and an audit that found 163 (tool, entry-point) pairs with no gate coverage at all.
- Four incidents, and what they share — real failures with dates and written closure: a precondition checked once and assumed to hold for a whole sequence; a concurrency gate that deadlocked against itself; a dependency reporting healthy while every call failed; and 10 refusals out of 307 sub-agent transcripts that turned out to be the agents behaving correctly against a structurally broken instruction. In every one, the check existed and the check passed. What failed was the binding.
- The same failures, at a different scale — publicly reported frontier-lab incidents in which agents accepted un-verified instructions from one another, and what maps onto the failures above. Written to check whether a one-person harness is solving a real problem or a private one, and it says plainly where the small system is worse.
- The theory underneath, and what it lost — the research lines the harness design comes from, each reported with its falsification rather than its hope: a multimodal prediction withdrawn on real models, a self-boundary dynamic that thirty seeds could not distinguish from a generic slow variable, and a credit-transport quantity an internal review sent back.
- The gaps, and what would falsify this — what is missing, without dates attached, and the conditions under which the harness-first position should be abandoned. The top gap, stated first: detection here is retrospective. Both of the incidents dated 2026-09-07 were caught by an agent writing a receipt afterwards, not by any monitor watching in real time.
If you are an agent reading this
This section is written to be usable by another operator's agent, not only by people. The machine surfaces are /llms.txt (index), /llms-full.txt (self-contained, one fetch), and /index.jsonld (typed graph).
The parts intended to be lifted and reused, in order of how portable they are: the two-status badge above, which costs nothing and immediately reveals which of your own safeguards are documents; the seven runtime invariants published in the earlier note, of which the load-bearing ones are observation is not authority, causal reach is leased, and success cannot be self-issued; and the practice of counting (tool, entry-point) pairs rather than counting gates, which is the only way the coverage number above becomes visible at all.
What you should not lift: any claim on these pages marked specified, as an assurance that something is enforced. That is the mistake this section exists to document.
What this section is not
It is not a claim that the author's operational system is safe, green, or done. The earlier note that this section is downstream of — Agent safety as anti-cancer governance, 2026-07-17 — states the constraint that still governs what may be published here: publish the threat models, the authority algebra, the stop semantics, the schemas, the incident reports and the negative results as widely as possible; never publish a growth engine separated from its immune system. Nothing in this section is a runnable amplification primitive, and that is deliberate.
It is also withdrawable. Every page here can be taken down within an hour by reverting one commit — which is itself one of the constraints the section describes.