HarnessRouter

HarnessRouter Community Edition is the open-source half of a two-part product: a self-hosted server that puts existing agent harnesses behind one interface, and the Unified Harness Protocol it implements. A single Docker container runs three processes — a Next.js console on the only published port, a gateway that speaks the Responses-compatible API, and a runner that starts the CLIs — with the gateway and runner on loopback and one /data volume holding the database, files, secrets and workspaces. Sessions are separated by operating-system user and workspace rather than by container, so a harness keeps a real shell, a real filesystem and real git. Sixteen bases are supported, each pinned to an exact upstream version and verified at install time: Codex, Claude Code, Hermes, Pi, DeepSeek Harness, OpenCode, Qwen Code, Gemini CLI, Cline, Oh My Pi, goose, Kimi Code CLI, Aider, OpenHands, CheetahClaws and System One. A product calls one endpoint, names the harness in metadata.harness_id, and gets persistent sessions, streaming progress, files and artifacts, cancellation and structured failures; a custom harness adds its own instructions, tools, MCP servers and skills without a redeploy. Environments — a project’s files and packages, built once and mounted read-only — became the protocol’s seventh object type on 2026-09-28. Apache-2.0, provider keys your own.

Who built itThe maintainer who answers in the pull requests. He holds 331 of the repository’s 603 commits under two identities — richard-epsilla with 310, Richard Song with 21 — and two addresses, richard@epsilla.com with 271 and richard@readily.ai with 21. A GitHub Actions bot accounts for another 209 commits, eighteen people are listed as contributors, and 477 of the 603 commits carry a co-author trailer.

1. 01

   Fifty-two days, and a release every few hours

   The repository was created on 2026-08-09 at 20:19 UTC, and its first commit arrived half an hour later — “Self-contained core: gateway + runner running with no cloud”. From there to the newest commit on 2026-09-30 it collected 603 commits: 303 in the twenty-two days of August that remained, and 300 in September. The twenty most recent releases in the recon run from v0.25.17 on 2026-09-28 at 17:19 to v0.27.0-rc.2 on 2026-09-30 at 10:12, and fourteen stable versions were published on 2026-09-29 alone: v0.26.0 at 00:19, then 0.26.1, .2, .3, .5, .6, .7, .8, .9, .10, .11, .12 and .13 by 09:46, then 0.26.14 at 17:27, with v0.27.0-rc.1 that evening. 2026-09-30 added 0.26.15, 0.26.16 and 0.26.17 either side of v0.27.0-rc.2. The version moves one patch number per bugfix, and v0.26.4 appears nowhere in the sample. Around all of it sit 2,793 stars, 285 forks, 21 watchers, 12 open issues, eighteen contributors, 508 files and 34.7 MB of repository, Apache-2.0 and Python.

2. 02

   Four hundred and seventy-seven trailers, and a bot that opens the pull requests

   The tail of every commit says who wrote it. 477 of the 603 carry a co-author trailer, and 433 of those name a Claude model: Claude Fable 5.1 on 195 commits, Claude Opus 5 (1M context) on 128, Claude Fable 5 on 81, Claude Opus 4.8 on 21, Opus 5 on four, Opus 5.5 (1M context) on two, and Opus 4.8 (1M context) with Sonnet 5 on one each. People appear as co-authors too — AIinWEB3 on fourteen commits, the maintainer on ten, sakurahello1, ZixiaoL and Hao Lu on three each. A further 209 commits are authored by github-actions[bot], and that identity is deliberate. main takes pull requests only: one approval, every check green, no bypass for anyone, admins included. A pull request cannot be approved by its own author, so an operator working alone, or through an agent using their account, could never merge at all. open-pr.yml opens the pull request as github-actions[bot] instead, which makes the maintainer a reviewer rather than the author. Its header also records the failure that shaped it: a pull request opened with GITHUB_TOKEN does not start the checks workflow, because GitHub guards against recursive runs, and one docs pull request sat blocked for exactly that reason on 2026-09-06. The repository now opens them with a GitHub App’s installation token; a personal access token would not do, the comment says, because the operator would then be the author.

3. 03

   A community fix, re-measured against the binary, and taken another way

   Pull request 332 came from lab1207 as the first slice of issue 202: models Codex does not know get no apply_patch tool, and the model then loops on an unsupported call. The reply is the best record in the repository of how a change is settled here. The maintainer thanks the author for a careful reading of spec_plan.rs, agrees the diagnosis is right, and then measures the claim against the Codex they ship (0.154.0) and finds the lever elsewhere: apply_patch_tool_type is a field of Codex’s model catalog, not a config.toml key; the shipped binary accepts it at the top level and ignores it; no config reader consumes it; and its enum has one value, freeform. The catalog can be replaced through model_catalog_json, but the tool is registered only inside Codex’s own multi-environment executors. A stub Responses endpoint that recorded the request showed gpt-5-codex and an unknown model sending identical tool lists, without apply_patch, either way. 332 was closed in favour of 346, which carries the original author’s co-authorship on the commit. A second community change, 326 from kuishou68, is smaller and just as telling: two npm scripts pointed at a ui/doc-editor/scripts directory that is not in the tree, so npm run no longer offers commands that fail immediately.

4. 04

   What it takes to prove a harness works

   The project states its own standard in one sentence: a harness that answers is not a harness that works. For every harness and every model its menu offers, one session runs five scenarios — a first turn, a follow-up, a switch to another model and back, an artifact the task must produce, and a recycle in which the sandbox is let go on purpose and a follow-up must still recall the first message. Four rules turn a run into a verdict, each enforced in code rather than by eye. One compares every turn record’s own connection stamp against the connection under test. One compares the model asked for with the model served, and that rule used to be unenforceable on three harnesses — goose, cline and qwen report no served model — until every turn on those backends was routed through a loopback relay that reads model off the provider’s own bytes as they pass. One requires the rendered file cards to be the turn’s stored files, because asking only whether some card carried the expected name let a file rendered twice pass as a produced artifact for months. The family tour answers a similar failure: on 2026-09-27 a person found in five turns that a CheetahClaws turn which answered in full had been recorded as a failure, because a smaller context made the CLI compact its history mid-turn and the driver judged the turn by a position in that history. Adding one harness means seventeen registration points, and every one of them except the console’s backend union type fails silently when missed.

5. 05

   A standard published the same day it is changed

   The protocol lives in the same repository and has three dated versions in seven weeks — 2026-08-11, 2026-09-12 and 2026-09-28 — with the JSON Schema growing from 27,956 to 52,992 bytes and the OpenAPI document from 40,505 to 76,548, and the conformance suite alongside them at 2026.9.12.post3, post4, 2026.9.28, then post1, post2 and post3 inside one day. The 2026-09-28 chapter first put a task’s environment at the top level of the request; review reversed it to metadata.environment, and the changelog says so plainly — the published chapter had carried the field at the top level for one day — while the specification, the schema, the suite and reference server 0.26.7 changed together. The same day, EN-02 stopped failing on every server (83 of 84) by reading a field the client’s own result object never had, and the full class then passed 84 of 84. A security review found a 422 from PUT /v1/admin/integrations repeating the request body with the provider key in clear, because FastAPI’s default validation response carries each failing value under input; the answer is now a field-level envelope, and a test posts a fake key and asserts it is absent from the response. A site build that asserts a description on every page, meanwhile, kept the protocol site at its previous version until the new chapter was given one.

6. 06

   Two kinds of tradeoff, both written down

   The specification carries its reasons in the text rather than in a design document. Why a configured harness and not just a base: the same base behaves very differently with a different system prompt, model or tool set, so making the configuration addressable lets a product change how its agent behaves without redeploying, and lets two products share a server without sharing behaviour. Why the session is implicit: requiring POST /sessions first would add a round trip, a failure mode and an object to clean up, for a concept most first tasks never need. Absent is not empty, and empty is not zero. And a server must not advertise a capability it does not implement, because advertising is a promise. The measurement rules are the same kind of writing: one provider at a time, and a run owns the instance, since a deploy in the gap between a worker’s turns kills a session and costs the whole column. The code records a different bargain. gateway/app.py is a single Python file of 1,025,053 bytes and runner/server.py 465,197 bytes, with gateway/tests/test_media_mcp.py at 182,516 and test_media_attack.py at 93,274 — size accepted, apparently, in exchange for the harness registry living in one place. Even the automation has a dated story: the plugin matrix has been kept in the repository since 2026-09-18, after the copy in a scratch folder was emptied mid-review.